Senate Committee — SECD — Brief — 2024-11-13_secd_c-26_brief_ccla_e

SECD / Brief / 2024-11-13_secd_c-26_brief_ccla_e

Senate Committees

SUBMISSION TO THE STANDING SENATE COMMITTEE ON NATIONAL SECURITY, DEFENCE AND VETERANS AFFAIRS REGARDING BILL C-26,

AN ACT RESPECTING CYBER SECURITY, AMENDING THE TELECOMMUNICATIONS ACT AND MAKING CONSEQUENTIAL AMENDMENTS TO OTHER ACTS CANADIAN CIVIL LIBERTIES ASSOCIATION Anaïs Bussières McNicoll | Director, Fundamental Freedoms Program and Interim Director, Privacy, Technology and Surveillance Program Noa Mendelsohn Aviv | Executive Director and General Counsel NOVEMBER 13, 2024 Canadian Civil Liberties Association 124 Merton St., Suite 400 Toronto, ON M4S 2Z2 Phone: 416-363-0321 www.ccla.org

Overview The Canadian Civil Liberties Association (“CCLA”) is an independent, national, nongovernmental organization that was founded in 1964 with a mandate to defend and foster the civil liberties, human rights, and democratic freedoms of all people across Canada. Our work encompasses advocacy, research, and litigation related to the criminal justice system, equality rights, privacy rights, and fundamental constitutional freedoms. Working to achieve government transparency and accountability with strong protections for personal privacy lies at the core of our mandate.

Cybersecurity is an essential part of national security, and the digital ecosystem in which we increasingly live our lives needs to be safe, reliable, and secure from threats. Cybersecurity is also crucial for our democratic institutions, the economy, critical infrastructure, national defence, and the privacy of our online life. It is thus important that Canada take steps toward protecting the digital foundations on which modern life is built. However, cybersecurity should not undermine civil liberties.

While the work accomplished by the Standing Committee on Public Safety and National Security did address some of the civil liberties concerns associated with Bill C-26, several issues still need to be tackled. The attached joint submission on Bill C -26, which CCLA endorses, addresses key outstanding concerns through 4 categories of recommendations.

These recommendations call on Bill C -26 to be amended to (1) prohibit the government from undermining encryption and communications security; (2) ensure that government orders cannot remain secret indefinitely; (3) address significant privacy shortcomings; and (4) ensure that all government departments and agencies use information obtained under Bill C -26 exclusively for the cybersecurity and information assurance activities for which the information is collected.

The recommended remedies address pressing concerns likely to undermine public trust while still enabling the legislation to fulfill its stated goals: bolstering cybersecurity across the financial, telecommunications, energy, and transportation sectors, and helping organizations better prepare, prevent, and respond to cyber incidents. We u rge the Committee Members to adopt these proposals for strengthening Bill C-26.

JointCivilSocietySenateSubmissiononBillC-26 JointCivil SocietySenateSubmissiononBill C-26 CanadianCivil LibertiesAssociationCanadianConstitutionFoundationInternational Civil LibertiesMonitoringGroupLiguedesDroitsetLibertésNational Council ofCanadianMuslimsOpenMediaPrivacyandAccessCouncil ofCanadaProfAndrewClementDr.

BrendaMcPhail TableofContents: ExecutiveSummary: 2 Recommendation1:Prohibitthegovernmentfromunderminingencryptionandcommunicationssecurity 4Overview: 4Recommendation: 5 Recommendation2:Ensurethatgovernmentorderscannotremainsecretindefinitely 7Overview: 7Recommendation: 8 Recommendation3:FixBill C-26’sseriousprivacyfailings 11Overview: 113.1-Ensurethatpriorjudicial approval isrequired, exceptingenuinelyexigentcircumstances, toobtainconfidential information: 123.2-ResolvetheinconsistencybetweentheCCSPAandtheTelecommunicationsActregardingthehandlingofpersonal information, includingde-identifiedinformation: 133.3-EnsurethatDataRetentionPeriodsareattachedtotelecommunicationsproviders’dataandtoforeigndisclosuresofinformation: 14 Recommendation4:RestricttheCSEtousinginformationobtainedunderBillC-26exclusivelyforcybersecurityandinformationassurancepurposes 17Overview: 17Recommendation: 18 References&Resources: 20 1

JointCivilSocietySenateSubmissiononBillC-26 ExecutiveSummary: HonourableSenators, Asorganizationsandindividualscommittedtoupholdingcivillibertiesandthefundamentalrighttoprivacy,wesharetheGovernmentofCanada’sobjectiveofstrengtheningcybersecurityacrossthepublicandprivatesectors,andsupportingeveryoneinCanadatobebetterabletoprotectthemselvesagainstcyberattacks.

Atthesametime,however,thecurrentformofBill C-26, AnActrespectingcybersecurity,amendingtheTelecommunicationsActandmakingconsequential amendmentstootherActs(“BillC-26”hereafter),containssignificantflawsthatmaycompromisecivillibertiesandcybersecurity —and,therefore,nationalsecurity. Thereisnoreasonwhycybersecurityshouldcomeatthecostofcivilliberties.Indeed,publictrustisessentialforcybersecuritytobeasuccess,especiallyatatimewhenpublictrustindemocraticinstitutionsiserodinginCanadaandacrosstheglobe.Abillwhichfailsthedemocraticlegitimacytestwillfailtostrengthencybersecurity.

WefirstitemizedourconcernsinaSeptember2022jointlettertoformerPublicSafetyMinisterMarcoMendicino,andwereencouragedtohearthemreflectedbyMembersofParliamentfromallpartiesthroughoutBillC-26’s2ndReadingdebate. WefollowedupbysubmittingadetailedpackageofRecommendedRemedies(English,Francais)toMPsontheHouseofCommonsStandingCommitteeonPublicSafetyandNationalSecurity(SECU).Severalofustestifiedatthesubsequenthearingstoprovidelegislatorswithadditionalinsights.

Throughoutthiswork,wedrewfromtheexpertfindingsofDr.ChristopherParsons,assetoutinhisOctober2022reportCybersecurityWill NotThriveinDarkness:ACritical AnalysisofProposedAmendmentsinBill C-26totheTelecommunicationsAct,whichwaspublishedbytheCitizenLabattheUniversityofTorontoinOctober2022. WhiletheworkanddedicationofSECUCommitteemembersandotherMPsfromacrossthepoliticalspectrumhaveresolvedsomeofthecivillibertiesconcernsassociatedwiththelegislation,severalsignificantandoutstandingissuesremainoutstanding.

Giventhatthereremainseveral areasofseriousconcern,andtheconstitutionalroleoftheSenate,webelievethatyouhaveacriticalroletoplayinensuringthatBillC-26deliversstrongcybersecurity,whileprotectingprivacy,ensuringaccountability,andupholdingtherightsofeveryoneinCanada. Werespectfullyhighlightthefollowingfourareasasprioritiesforyourconsideration: 2

JointCivilSocietySenateSubmissiononBillC-26 BillC-26:PriorityRecommendations 1. Prohibitthegovernmentfromunderminingencryptionandcommunicationssecurity 2. Ensurethatgovernmentorderscannotremainsecretindefinitely 3. FixBill C-26’sseriousprivacyfailings 4. RestricttheCSEandothergovernmentagenciestousinginformationobtainedunderBill C-26exclusivelyforcybersecurityandinformationassurancepurposes Inwhatfollowsbelow,weprovidemoredetailonthesepriorityrecommendations.WelookforwardtodiscussingtheserecommendationsfurtherwithmembersoftheSenatewhenyourscrutinyofBillC-26commences. 3

JointCivilSocietySenateSubmissiononBillC-26 Recommendation1:Prohibitthegovernmentfromunderminingencryptionandcommunicationssecurity Overview: BillC-26,aspassedbytheHouseofCommons,containsadangerousloophole.Specifically,thenewministerialpowerssetoutinsection15.2(2)oftheTelecommunicationsActamendmentscouldbeusedtodeliberatelyorinadvertentlycompromisethesecurityoftelecommunicationsnetworksthatpeople,governments,andbusinessesacrossCanada(andbeyond)relyuponeveryday.

Thisisespeciallythecaseregardings.15.2(2)(l)whichgivesthegovernmentthepowertorequiretelecommunicationsprovidersto“implementspecifiedstandardsinrelationtoitstelecommunicationsservices, telecommunicationsnetworksortelecommunicationsfacilities." Thedangeristhatsuchabroadly-wordedpowercouldbeusedtocompelproviderstoadoptstandardswhichweaken,ratherthanstrengthen,encryptionandprivacy.Ascurrentlydrafted,thestatutorylanguageendangersthefreedomofpeopleinCanadatocommunicateprivatelywithoneanother,orbusinessestosafelyengageinnationalandinternationalcommerce,orgovernmentsandelectedrepresentativestoenjoyprivatecommunications.

Cybersecurityexperts,inCanadaandelsewhere,havecautionedthatthecurrentstatutorylanguageendangersCanada’seconomy,itsinternationalrelations,andthefundamentalrighttoprivacyofpeopleacrossCanada: ● WritingforTheGlobe&Mail,CitizenLab’sKateRobertsonandRonDeibertwarnthatthe“secretive, encryption-breakingpowers”inBillC-26“threatentheonlinesecurityofeveryoneinCanada,”andthatthebill “empowersgovernmentofficialstosecretlyordertelecommunicationscompaniestoinstall backdoorsinsideencryptedelementsinCanada’snetworks.” ● InhistestimonytotheparliamentarycommitteestudyingBillC-26,EricSmith,SeniorVice-PresidentattheCanadianTelecommunicationsAssociation,referencedthe“verybroad”order-makingpowersinBillC-26,statingthat“Itcouldberequiringyounotnecessarilytotakeoutequipmentfromyourinfrastructure, buttoputcertainequipmentintoyourinfrastructure, ortocomplywithcertainstandards.

Itcouldbeweakeningencryption, oritcouldberequiringyoutointerceptcommunications." ● CitingtheUSasanexampleofgovernmentoverreachthatCanadashouldavoid,theElectronicFrontierFoundationstatedthat"theU.S. experienceoffersacautionarytaleofwhatcanhappenwhenagovernmentgrantsitselfbroadpowerstomonitoranddirecttelecommunicationsnetworks, absentcorrespondingprotectionsforhumanrights,”andwarnedthat"withoutadequatesafeguards, Bill C-26couldopenthedoortosimilarpracticesandorders." 4

JointCivilSocietySenateSubmissiononBillC-26 Despitehavingreceivedmultiplebriefs(e.g. here, here, here,andhere)andhearingfromseveralwitnesses(e.g. here, here, here,andhere)onthistopic,SECUdidnotconsiderthematterduringitsclause-by-clausereviewofBillC-26.TheHouseofCommonsalsoeschewedtheopportunitytodosoduringReportStage,despiteurgingsthatParliamentariansaddressthem.Instead,BillC-26wasrushedthroughReportStagewithoutanydebate. Thisfliesinthefaceofthegovernment’sunequivocalstatementsthroughouttheSECUCommitteereviewthatBillC-26’spurposeisnetworksecurity,notsurveillance.

Recommendation: ThedangertoCanadians’ communicationssecuritycanbeaddressedsimply,bymakingitexplicitinstatutewhatkindsofstandardsarewithinandbeyondthescopeofthelegislation: TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedy: Scopeandsubstance15.2(2. 1) Theprovisionsofanordermadeundersubsection(1)or(2)must,inscopeandsubstance,bereasonabletothegravityofthethreatofinterference,manipulation,disruptionordegradation.

Forgreatercertainty15.2(2. 2) Forgreatercertainty,despitesubsection(2),theMinisterisnotpermittedtoorderatelecommunicationsserviceprovidertointerceptaprivatecommunicationoraradio-basedtelephonecommunication,asthosetermsaredefinedinsection183oftheCriminalCode. Scopeandsubstance15.2(2. 1) Theprovisionsofanordermadeundersubsection(1)or(2)must,inscopeandsubstance,bereasonabletothegravityofthethreatofinterference,manipulation,disruptionordegradation.

Forgreatercertainty15.2(2. 2) Forgreatercertainty,despitesubsection(2),theMinisterisnotpermittedtoorderatelecommunicationsserviceprovidertointerceptaprivatecommunicationoraradio-basedtelephonecommunication,asthosetermsaredefinedinsection183oftheCriminalCode. Forgreatercertainty15.2(2.3)Forgreatercertainty, despitesubsection(2), theMinisterisnotpermittedtomakeanorderthatwouldcompromisetheconfidentiality, availability, orintegrityofatelecommunicationsfacility, telecommunicationsservice, ortransmissionfacility.

Thisrecommendationismeanttoensurethatthegovernmentisempoweredtoissueorderscompellingtelecommunicationsproviderstostrengthentheconfidentialityandsecurityoftheirnetworks,butnottoweakenthem. Thisamendmentisintendedtopreventthegovernmentfromorderingordemandingthattelecommunicationsserviceprovidersdeployorenable(orhavedeployedorenabled) 5

JointCivilSocietySenateSubmissiononBillC-26 lawful-accessrelatedcapabilitiesorpowersintheserviceof‘securing’ infrastructurebywayofadoptingastandard.Ifthegovernmentwishestopursueenhancedlawfulinterceptionpowers,itshoulddosobywayofseparatelegislativeprocesses. AcrossCanada,peopleandbusinessesrelyonthestrengthandconfidentialityofencryptednetworkstokeeptheircommunicationssafeandsecure.ThecriticalimportanceofsecurecommunicationsisreinforcedbythefactthattheCommunicationsSecurityEstablishment(CSE)recentlyintroducedend-to-endencryptiontoCanada’sTopSecretNetwork(CTSN)—seepage9ofCSE’srecentannual report.

WhetheritistheCSE,alargecorporation,asmallbusiness,politicalrepresentatives,orneighboursexchangingnewsandviews,everybodyinCanadamustbeabletohavetrustinthesecurityoftheircommunications.Thisrecommendationwillensurepreciselythat. 6

JointCivilSocietySenateSubmissiononBillC-26 Recommendation2:Ensurethatgovernmentorderscannotremainsecretindefinitely Overview: ThecurrentlanguageinBillC-26allowsthegovernmenttokeepsecretanyordermadetotelecommunicationsproviders,andtooperatorsdesignatedundertheCritical CyberSystemsProtectionAct(CCSPA).UnderthecurrentwordingofBillC-26,asamendedbytheHouseofCommons,telecommunicationsprovidersanddesignatedoperatorsareprohibitedfromevendisclosingthefactthatanorderwasissued,letaloneitscontents.

Weappreciatethatsecrecymightbewarrantedincertaincircumstances;butsecrecyshouldneitherbethedefaultnorbepermittedtoremaininplaceindefinitely.Inademocracy,thegovernmentmustensurepeoplecanunderstandhowitexercisesitscybersecurityandotherpowers,howoften,andtowhateffect,toensurethatdecision-makerscanbeproperlyheldtoaccount.

TheconcernaddressedbythisRecommendationaroseduringtheSECUCommittee’sclause-by-clausereview,whenBlocQuebecoisMPKristinaMichaudproposedanamendment—basedcloselyonoursubmissiontothecommittee—whichwouldhaverequiredanorderfromtheFederalCourtasacheck-and-balanceagainstgovernmentoverreach,soastoensurethegovernmentcannotconcealdisproportionatelyintrusiveactionsundercoverofsecrecy. Governmentofficialsresistedthisproposedamendment,andarguedthatit“couldleadtoefficiencyrisks.

Forexample, aFederal Courtprocesswouldtakeatleastafewweeks.”Tosupporttheirargument,theypointedtoseriouscybersecurityincidentsinwhichurgentgovernmentactionhadbeenrequired,andassertedthattheproposedamendmentmightimpedeemergencyresponses.

MPJenniferO’Connell,thegovernment’sparliamentarysecretaryforcybersecurity,echoedMPMichaud’sconcerns.Sheproposedanalternativeamendmentrequiringnotificationofallorders,includingconfidentialones,totheNationalSecurityandIntelligenceCommitteeofParliamentarians(NSICOP)andtheNationalSecurityandIntelligenceReviewAgency(NSIRA).Thegovernment’samendmentpassed,andisnowreflectedins.15.22oftheTelecommunicationsAct,ands.20(4)oftheCCSPA.

Althoughthegovernment’samendmentwasanimportantandpositivestep, itfallsfarshortofaddressingthecoreproblem:thepotential forgovernmentcybersecurityorderstoremainsecretindefinitely, withoutthevalidityofsuchsecrecyeverbeingreviewedbyacourt. 7

JointCivilSocietySenateSubmissiononBillC-26 Recommendation: Weacknowledgetheconcernthattherewillbeoccasionswhenthegovernmentneedstotakeswiftcybersecurityactions,andmaydeterminethatthedelayrequiredtoobtainaFederalCourtorderisexcessiveinthecircumstances.Accordingly, wesuggestarevisedamendmenttorecognizetheneedforextraordinaryactioningenuinelyexigentcircumstances,whichalsoensuresacourtwouldreviewthevalidityofsecrecyofallorders,within90daysofeachsuchorderbeingissued.

Thisrecommendationwouldimposea90-daytimelimitontheconfidentialityprovisionsofallorders,andanyextensionwouldrequirethegovernmentbringinganapplicationtotheFederalCourt: TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedies: Non-disclosure15.1(2)Theordermayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson.

Non-disclosure15.1(2)(a)Theordermayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson,foraperiodofupto90daysafterthedayonwhichitismade. 15.1(2)(b)(i)TheGovernorinCouncilmaybringanapplicationtotheFederalCourtforanordertoextendtheperiodduringwhichthedisclosureofsomeorallofthecontentsoftheorderissuedundersubsection(1)isprohibited.TheFederalCourtmaymakeanordertothateffectwhereitissatisfiedthattherearereasonablegroundstobelievethatthedisclosureofsomeoralloftheorderwouldbeinjurioustointernationalrelations,nationaldefenceornationalsecurityorendangerthesafetyofanyperson. 15.1(2)(b)(ii)Thejudge,inconsiderationoftheprinciplesoffairnessandnaturaljustice,shallappointaspecialcounselfromthelistofpersonsreferredtoinsubsection85(1)oftheImmigrationandRefugeeProtectionActforthepurposesofcontestingtheGovernorinCouncil'sapplication.

Non-disclosure15.2(3)Anordermadeundersubsection(1)or(2)mayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson. Non-disclosure15.2(3)(a)Anordermadeundersubsection(1)or(2)mayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson,foraperiodofupto90daysafterthedayonwhichitismade. 15.2(3)(b)(i)TheMinistermaybringan 8

JointCivilSocietySenateSubmissiononBillC-26 applicationtotheFederalCourtforanordertoextendtheperiodduringwhichthedisclosureofsomeorallofthecontentsoftheorderissuedundersubsection(1)or(2)isprohibited.TheFederalCourtmaymakeanordertothateffectwhereitissatisfiedthattherearereasonablegroundstobelievethatthedisclosureofsomeoralloftheorderwouldbeinjurioustointernationalrelations,nationaldefenceornationalsecurityorendangerthesafetyofanyperson. 15.2(3)(b)(ii)Thejudge,inconsiderationoftheprinciplesoffairnessandnaturaljustice,shallappointaspecialcounselfromthelistofpersonsreferredtoinsubsection85(1)oftheImmigrationandRefugeeProtectionActforthepurposesofcontestingtheMinister’sapplication.

AsimilarsituationappliestotheCritical CyberSystemsProtectionAct(CCSPA),whichallowsthegovernmenttokeepsecretanyordermadetodesignatedoperators.Thisisparticularlyproblematicgiventhereisnoautomaticpublicnotificationmechanismforneworders.Again,whiletherearecertainlysituationsinwhichsecrecymightbeappropriate,secrecyshouldnotbethedefaultinarobustdemocracysuchasCanada’s.

Thefollowingsuggestedamendmentwouldpermitdesignatedoperatorstodisclosetheexistenceofadirection,butnotitscontent,excepttotheextentnecessarytocomplywiththedirection: CCSPACurrentText CCSPARecommendedRemedies: Prohibitionagainstdisclosure24Everydesignatedoperatorthatissubjecttoacybersecuritydirectionisprohibitedfromdisclosing,orallowingtobedisclosed,thefactthatacybersecuritydirectionwasissuedandthecontentofthatdirection,exceptinaccordancewithsection25.

Prohibitionagainstdisclosure24Everydesignatedoperatorthatissubjecttoacybersecuritydirectionisprohibitedfromdisclosing,orallowingtobedisclosed, thefactthatacybersecuritydirectionwasissuedandthecontentofthatdirection,exceptinaccordancewithsection25. Disclosure—whenallowed25

(1) Adesignatedoperatorthatissubjecttoacybersecuritydirectionmaydisclosethefactthatthedirectionwasissuedanditscontentonlytotheextentnecessarytocomplywiththedirection. Disclosure—whenallowed25

(1) Adesignatedoperatorthatissubjecttoacybersecuritydirectionmaydisclosethefactthatthedirectionwasissuedanditscontentonlytotheextentnecessarytocomplywiththedirection. 9

JointCivilSocietySenateSubmissiononBillC-26 Finally,theStandingJointCommitteefortheScrutinyofRegulationsplaysakeyroleinCanada’sdemocraticprocess.BillC-26shouldbeamendedsuchthattheStandingJointCommitteefortheScrutinyofRegulationsisabletoobtain,assess,andrenderaverdict,whichmustpromptlybemadepublic,onanyregulationsthatarepromulgatedundertheproposeddraftreformstotheTelecommunicationsActandCanadaCyberSystemsProtectionAct.

TheCommitteeshouldalsobeempoweredtoobtain,assess,andrenderaverdict,whichmustpromptlybemadepublic,onregulationspertainingtotheTelecommunicationsActandthataremodifiedpursuanttos.18oftheStatutoryInstrumentsAct.

ThefollowingclausesinBillC-26,whichexemptthelegislationfromtheStatutoryInstrumentsAct,shouldbeeitherdeleted,oramendedtomakeclearthattheStatutoryInstrumentsActapplies: ● Section15.3(3)oftheTelecommunicationsActamendments● Sections22(1),34(2),36(3),43(2),45(3),52(2),54(3),61(2),63(3),70(3),73(4),80(2),and82(3) oftheCCSPA Incorporatingtheaboverecommendationswillgreatlyimprovetransparencyand,accordingly,publicconfidenceandtrustinhowthegovernmentusesthesweepingnewpowersitisgrantingitself. 10

JointCivilSocietySenateSubmissiononBillC-26 Recommendation3:FixBill C-26’sseriousprivacyfailings Overview: SinceBillC-26wasfirstrevealedinJune2022,privacyhascontinuedtobeoneofourforemostconcerns.InourSeptember2022JointLettertothethenPublicSafetyMinisterMarcoMendicino,wewarnedthat: “Bill C-26empowersthegovernmenttocollectbroadcategoriesofinformationfromdesignatedoperators, withinanytimeandsubjecttoanyconditions.

Thismayenablethegovernmenttoobtainidentifiableandde-identifiedpersonal informationandsubsequentlydistributeittodomestic, andperhapsforeign, organizations.” WerecognizethatsomeprogresshasbeenmadeonthisfrontasBillC-26progressedthroughtheHouseofCommons,suchas: ● Telecommunicationsproviders,whichretainvastquantitiesofCanadians’ mostsensitiveinformation,cannowdefinepersonalandde-identifiedinformationas“confidential”—withtheeffectofimposingsignificantlystrongerprotectionsforitshandling,storage,andsafeguarding. ● ThePrivacyActnowexplicitlyappliestotheextensiveinformation-sharingprovisionsinboththeTelecommunicationsActamendmentsandtheCCSPA.

However,Canadians’ privacycontinuestobeputinjeopardyasaresultofBillC-26’sstatutorylanguage.Someofthemostglaringproblemsare: ● Thegovernmentcanstilldiscloseconfidentialinformation,obtainedfromtelecommunicationsproviders,toanyone,withoutfirstobtaininganorderfromtheFederalCourt.Thegovernmentarguedthatthispowerwasrequiredtoavoiddelayedresponsestoemergencies;however,ourproposedamendment(setoutbelow),amelioratestheseconcerns. ● TheSECUCommitteecreatedalegislativeinconsistencyinfailingtopassanamendmentthatwouldhaveexplicitlydefinedpersonalandde-identifiedinformationas“confidential”fortheCCSPA,asitdidfortheTelecommunicationsAct. ● TheSECUCommitteehadsoughttoprotectCanadians' privacybylimitingdataretentionperiods(ref: amendmentbyKristineMichaud).However,thisamendmentwasoverturnedwithoutdebateattheReportStage,withtheeffectofenablingpotentiallyindefiniteretentionofCanadians' personalinformation 11

JointCivilSocietySenateSubmissiononBillC-26 WestronglyencourageyoutosystematicallyaddressthesefundamentalshortcomingsduringyourstudyofBillC-26,andimplementthefollowingrecommendations: 3.1-Ensurethatpriorjudicial approval isrequired, exceptingenuinelyexigentcircumstances, toobtainconfidential information: Ascurrentlydrafted,BillC-26allowstheMinistertorequirethedisclosureofconfidentialinformation—includingpersonalandde-identifiedinformation—fromdesignatedproviders.ThissweepingpowermustbesubjecttochecksandbalancestopreventtheMinisterfromcollectingandsubsequentlydisclosingpotentiallyinjuriousinformationwithoutfirstobtaininganorderfromtheFederalCourt.Otherwise,businessesandindividualsacrossCanadawillbeexposedtotheseriousriskofhavingtheirmostsensitiveinformationinappropriatelydisclosed.

Thelegislationshouldbeamendedsothat—beforethegovernmentcancompelatelecommunicationsprovidertodisclosepersonalorde-identifiedinformation—itmustfirstobtainarelevantjudicialorderfromtheFederalCourt,stipulatingthattheinformationcollectedpursuanttosuchorderistobeusedexclusivelyforthepurposesofmaking,amending,orrevokinganorderunders.15.1or15.2oraregulationunderparagraph15.8(1)(a),orofverifyingcomplianceorpreventingnon-compliancewithsuchanorderorregulation.

Recognizingthattherewillbeoccasionsinwhichinformationmustbedisclosedonanurgentbasis,ourrecommendationsincludeanaccommodationforgenuinelyexigentcircumstances,includingprovisionforretroactivereviewbytheFederalCourt.

TelecommunicationsActOriginal Text TelecommunicationsActRecommendedRemedies: 15.5(3)(c)thedisclosureisnecessary,intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulationordisruption. 15.5(3)(c)onapplicationtotheFederalCourt,ajudgeissatisfiedbyinformationonoaththattherearereasonablegroundstobelievethatthedisclosureisnecessary, intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem, includingagainstthethreatofinterference,manipulationordisruption. 15.5(3)(d)iftheconditionssetoutinsubsection(c)forobtainingaFederalCourtorderexist,butbyreasonofexigentcircumstancesinvolvinganimminentneedtosecuretheCanadiantelecommunicationssystemagainstthethreatofinterference,manipulation,ordisruption,itwouldbeimpracticabletoobtainaFederalCourtorder.Insuchcircumstances,theMinistershallwithin30daysmakeanapplicationtotheFederalCourt,andprovideinformationunderoathjustifyingthedisclosure. 12

JointCivilSocietySenateSubmissiononBillC-26 3.2-ResolvetheinconsistencybetweentheCCSPAandtheTelecommunicationsActregardingthehandlingofpersonal information, includingde-identifiedinformation: Asnotedabove,theTelecommunicationsActnowexplicitlydefinespersonalandde-identifiedinformationas“confidential”ins.15.5(1)(d).Thisisacriticallyimportantimprovementovertheoriginaldraft. However,thelegislativewordingshouldalsomakeclearthatpersonalinformationincludesde-identifiedinformation,becausethedefinitionof“personalinformation”carriesimportantPrivacyActprotections. TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedies: 15. 5

(1) Apersonwhoprovidesanyofthefollowinginformationundersection15. 4maydesignateitasconfidential: (

a) informationthatisatradesecret; (

b) financial,commercial,scientificortechnicalinformationthatisconfidentialandthatistreatedconsistentlyinaconfidentialmannerbythepersonwhoprovidedit; (

c) informationthedisclosureofwhichcouldreasonablybeexpectedto (

i) resultinmaterialfinanciallossorgaintoanyperson, (ii) prejudicethecompetitivepositionofanyperson,or (iii) affectcontractualorothernegotiationsofanyperson;or (

d) personalinformationandde-identifiedinformation. 15. 5

(1) Apersonwhoprovidesanyofthefollowinginformationundersection15. 4maydesignateitasconfidential: (

a) informationthatisatradesecret; (

b) financial,commercial,scientificortechnicalinformationthatisconfidentialandthatistreatedconsistentlyinaconfidentialmannerbythepersonwhoprovidedit; (

c) informationthedisclosureofwhichcouldreasonablybeexpectedto (

i) resultinmaterialfinanciallossorgaintoanyperson, (ii) prejudicethecompetitivepositionofanyperson,or (iii) affectcontractualorothernegotiationsofanyperson;or (

d) personalinformationandincludingde-identifiedinformation.

Definitions(1. 1) Thefollowingdefinitionsapplyinparagraph(1) (d). de-identify meanstomodifypersonalinformationsothatanindividualcannotbedirectlyidentifiedfromit,thoughariskofthe

Definitions(1. 1) Thefollowingdefinitionsapplyinparagraph(1) (d). de-identify meanstomodifypersonalinformationsothatanindividualcannotbedirectlyidentifiedfromit,thoughariskofthe 13

JointCivilSocietySenateSubmissiononBillC-26 individualbeingidentifiedremains. (dépersonnaliser) personal information hasthesamemeaningasinsection3ofthePrivacyAct. (renseignementspersonnels) individualbeingidentifiedremains. (dépersonnaliser) personal information hasthesamemeaningasinsection3ofthePrivacyAct. (renseignementspersonnels) (1.2)Anyinformationprovidedundersection15.4thatispersonalinformation,includinganyde-identifiedinformation,shallbedeemedtobeconfidential.

Furthermore,fortheavoidanceofdoubt,theCCSPAshouldbebroughtintolinewiththerevisedTelecommunicationsActinproactivelydefiningpersonalinformation,includingde-identifiedinformation,asconfidential: CCSPACurrentText CCSPARecommendedRemedies:

Definitions confidential information meansanyinformationobtainedunderthisActinrespectofacriticalcybersystemthat (

a) concernsavulnerabilityofanydesignatedoperator’scriticalcybersystemorthemethodsusedtoprotectthatsystemandthatisconsistentlytreatedasconfidentialbythedesignatedoperator; (

b) ifdisclosedcouldreasonablybeexpectedtoresultinmaterialfinanciallossorgainto,orcouldreasonablybeexpectedtoprejudicethecompetitivepositionof,adesignatedoperator;or (

c) ifdisclosedcouldreasonablybeexpectedtointerferewithcontractualorothernegotiationsofadesignatedoperator. (renseignementsconfidentiels)

Definitions confidential information meansanyinformationobtainedunderthisActinrespectofacriticalcybersystemthat (

a) concernsavulnerabilityofanydesignatedoperator’scriticalcybersystemorthemethodsusedtoprotectthatsystemandthatisconsistentlytreatedasconfidentialbythedesignatedoperator; (

b) ifdisclosedcouldreasonablybeexpectedtoresultinmaterialfinanciallossorgainto,orcouldreasonablybeexpectedtoprejudicethecompetitivepositionof,adesignatedoperator;or (

c) ifdisclosedcouldreasonablybeexpectedtointerferewithcontractualorothernegotiationsofadesignatedoperator. (renseignementsconfidentiels) (d)informationthatispersonalinformation,includingde-identifiedinformation. Finally,personalinformation,includingde-identifiedinformation,shouldalwaysbedeemedtobeconfidential,ratherthanthatdecisionbeinglefttothediscretionoftheentityprovidingit.ThisshouldbeaccomplishedbyadoptingRecommendation10ofCitizenLab’sSubmissiontothisCommittee: 14

JointCivilSocietySenateSubmissiononBillC-26 TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedies: Exception15.5(3) Informationthatisdesignatedasconfidentialmaybedisclosed,orbepermittedtobedisclosed,if (

a) thedisclosureisauthorizedorrequiredbylaw; (

b) thepersonwhodesignatedtheinformationasconfidentialconsentstoitsdisclosure;or (

c) thedisclosureisnecessary,intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulationordisruption. Exception15.5(3) Informationthatisdesignatedasconfidentialmaybedisclosed,orbepermittedtobedisclosed,if (

a) thedisclosureisauthorizedorrequiredbylaw; (

b) thepersonwhodesignatedtheinformationasconfidentialconsentstoitsdisclosure,orinthecaseofpersonalorde-identifiedinformation,thepersontowhomtheinformationrelatesconsentstoitsdisclosure. (

c) thedisclosureisnecessary,intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulationordisruption. 3.3-EnsurethatDataRetentionPeriodsareattachedtotelecommunicationsproviders’ dataandtoforeigndisclosuresofinformation: BillC-26mustbeamendedtomakeclearthatinformationobtainedfromtelecommunicationsproviders,oroperatorsdesignatedbytheCCSPA,willberetainedonlyforaslongasnecessarytomake,amend,orrevokeanorderundersection15.1or15.2oraregulationunderparagraph15.8(1)(a)oftheTelecommunicationsAct,orSection20oftheCCSPA,ortoverifythecomplianceorpreventnon-compliancewithsuchanorderorregulation.

AnamendmentapplyingdataretentionperiodstoinformationcollectedfromdesignatedoperatorsundertheCCSPAthatwasinitiallypassedbytheSECUcommitteeduringitsclause-by-clausereviewwaslaterreversed—withoutdebate—atReportStage. Thisbegsthequestion—ifthegovernmentclaimsitneedstocollectinformationforthespecificpurposeofmakingorders,whyisitopposedtorestrictingitsretentiontotheperiodforwhichitisnecessaryforthatpurpose?

WeurgeyourcommitteetoensurethatdataretentionperiodsapplytotheTelecommunicationsActandtheCCSPA,andthatsuchclausesalsoapplytoanyinformationdisclosurestoforeigngovernments,organizations,andentities: RECOMMENDEDREMEDY-TelecommunicationsAct: 15

JointCivilSocietySenateSubmissiononBillC-26 1.

Addafters. 15.7(2)thewords: “DataRetentionPeriods(3)AnyinformationcollectedorobtainedunderthisActwill beretainedonlyforaslongasnecessarytomake, amend, orrevokeanorderundersection15.1or15.2oraregulationunderparagraph15.8(1)(a), ortoverifythecomplianceorpreventnon-compliancewithsuchanorderorregulation. (4)RetentionperiodsshouldbecommunicatedtothepersonfromwhomtheMinister, orpersondesignatedbytheMinisterundersection15.4, hascollectedtheinformation. (5)Anyagreement, memorandumofunderstanding, orarrangementinwritingbetweentheGovernmentofCanadaandthegovernmentofaforeignstate, aninternational organizationofstatesoraninternational organizationestablishedbythegovernmentsofstates, mustincludedataretentionanddeletionclausestoensureitisretainedonlyforaslongasisnecessaryforthepurposessetoutinsubsection(1).” RECOMMENDEDREMEDY-CCSPA: 1.

Addafters. 26(3)thewords: “DataRetentionPeriods(4)AnyinformationcollectedorobtainedunderthisActwill beretainedonlyforaslongasnecessarytomake, amend, orrevokeanorderundersection20, ortoverifythecomplianceorpreventnon-compliancewithsuchanorderorregulation. (5)RetentionperiodsshouldbecommunicatedtothepersonfromwhomtheGovernorinCouncil hascollectedtheinformation. (6)Anyagreement, memorandumofunderstanding, orarrangementinwritingbetweentheGovernmentofCanadaandthegovernmentofaforeignstate, aninternational organizationofstatesoraninternational organizationestablishedbythegovernmentsofstates, mustincludedataretentionanddeletionclausestoensureitisretainedonlyforaslongasisnecessaryforthepurposessetoutinsubsection(1).” 16

JointCivilSocietySenateSubmissiononBillC-26 Recommendation4:RestricttheCSEtousinginformationobtainedunderBill C-26exclusivelyforcybersecurityandinformationassurancepurposes Overview: Initscurrentform,BillC-26wouldauthorizetheCommunicationsSecurityEstablishment(CSE)—Canada’ssignalintelligenceandcybersecurityagency—toobtainandanalyzesecurity-relateddatafromcompaniesthatCanadiansentrustwiththeirmostsensitivepersonalinformation—includingtelecommunicationsproviders,federally-regulatedfinancialinstitutions,energyproviders,andeveryotherentitydesignatedundertheCCSPA.

BillC-26amountstoadramaticexpansionofCSE’sinformationcollectionpowers.Thisisproblematic,becausetheCSE'suseoftheinformationitcollectsiscurrentlynotconstrainedtothecybersecurityaspectofitsmandate,andanyuseswouldbelargelysubjecttoafter-the-factreviewratherthanreal-timeoversight.

ThegovernmentassuresusthattheCSE'snewinformationcollectionpowersarenecessaryforcybersecuritypurposes,butitdoesnotfollowthatitiseithernecessaryorproportionatetousetheseexpandedpowersacrossallaspectsoftheCSE'smandate.AshighlightedinarecentarticlebylawprofessorMattMalone,publishedbytheCentreforInternationalGovernanceInnovation, “ThisdivergesmarkedlyfromthethrustoftheCSE’senablinglegislation, whichseekstoimposegreateraccountabilityovercertainconductthroughpriorauthorizationandreviewobligations.” Inshort,BillC-26riskserodingthecarefulprotectionsintheCommunicationsSecurityEstablishmentActagainstallowingtheCSEinsomeaspectsoftheirmandatefromdirectingactionsatCanadiansorpersonsinCanada,orcollectinginformationthatinterfereswiththereasonableexpectationofprivacyofapersoninCanada,asprotectedbyourCharter.

Thisisnotatheoreticalthreat.ItisclearfromthetestimonyofCSEofficialsduringSECU’sclause-by-clausereviewthattheCSEfullyintendstouseinformationitgathersforbothoffensiveanddefensivepurposes,andalsointendstoshareinformationitcollectswithitsFiveEyespartners. AskedtocommentonaBlocamendmentwhichwouldhaveconstrainedCSE’suseofinformationitgathers,CSE’sStephenBolton(DirectorGeneral,StrategicPolicy)replied: “InformationcollectedbyCSEpursuanttooneaspectofitsmandatecanbeusedbyCSEunderanotheraspectofthemandateaslongasitmeetsspecificconditionssetoutintheCSEAct.

Informationrelatedtosecurityprogramswill enableCSEanditscybercentretogainabetterunderstandingofthesupplychainriskofdesignatedoperatorsaswell astheintentionsofaforeignentityviaitspenetrationintorespectivesectors. 17

JointCivilSocietySenateSubmissiononBillC-26 WithoutbeingabletoleverageCSE'smandateasawhole, CSE'sunderstandingofforeignactors' intentionsagainstourcritical infrastructureandtheproperstrategicmitigationswouldbegreatlydiminished.

AnylimitationwouldalsoreduceCSE'scollaborationwithourFiveEyespartners.” [emphasisadded] Inotherwords,theCSEclaimsthatnotonlyareitsnewinformation-collectionpowersinBillC-26requiredforcybersecuritypurposes,italsoaimstousethemtosupportinternationalrelationswithothernations’ signalsintelligenceagencies.Whileouralliancesareimportant,Canadians’ personalinformationshouldnotbethecointomaintaintheserelations.

TheseriskstoprivacyanddemocraticaccountabilityareexacerbatedbytheCSE’slongtrackrecordoffailingtoembracetransparency.ThisincludestheCSE’sfailuretocooperatewiththeNationalSecurityandIntelligenceReviewAgencyinitsinvestigationsortoactonwithitsrecommendations.

Forexample,theCSEhaspreviouslyrejectedrecommendationsbytheNational SecurityandIntelligenceReviewAgency(NSIRA)thatit“obtainadditional legal adviceonitsinternalsharingofinformationbetweentheforeignintelligenceandcybersecurityaspectsofthemandate, explicitlyinrelationtocompliancewiththePrivacyAct,”claimingin2021thatithadalreadyreceivedlegaladviceonthematterfromtheDepartmentofJustice.

DespiteCSE’s2021refusal,NSIRArepeateditsrecommendationinitsmostrecentreviewpublishedJanuary2024,findingthat“CSE’sinternal sharingofinformationbetweentheFIandcybersecurityaspectsofthemandatehasnotbeensufficientlyexaminedforcompliancewiththePrivacyAct.” Inshort,aspresentlydrafted,C-26riskscontinuingasituationwheretheCSEinterpretsitsmandates--nowsuperchargedwithevenmoreCanadians’ personalinformation--inmannersthathavebeenfoundnon-compliantwiththePrivacyActbytheirreviewer.TheSenatehasaroleandobligationtopreventsuchamishandlingofCanadians’ oftenmostsensitiveinformation,especiallygiventheCSE’slongtrackrecordoffailingtocooperatewithitsreviewagencies.

Recommendation: BillC-26mustbeamendedtoensurethatallgovernmentdepartmentsandagencies,includingtheCSE,useinformationobtainedunderBillC-26exclusivelyforthecybersecurityandinformationassuranceactivitiesforwhichtheinformationiscollected. Suchinformationshouldnotbepermittedtobeusedforadditionalpurposes,suchassignalsintelligenceandforeignintelligenceactivities,cross-departmentassistanceunrelatedtocyber-security,oractiveordefensivecyberoperations.Theserestrictionsshouldapplytoallagencies,includingbutnotlimitedtothoseunderthepurviewoftheMinisterofPublicSafetyandEmergencyPreparedness. 18

JointCivilSocietySenateSubmissiononBillC-26 TelecommunicationsActOriginal Text TelecommunicationsActRecommendedRemedies: 1.

ADDafters.15.6(2)thewords: “15.6(3)Anyinformationsharedinaccordancewithsection15.6canonlybeusedbytherecipientpersonforpurposesexclusivelyrelevanttosecuringtheCanadiantelecommunicationssystemagainstthethreatofinterference, manipulationordisruption.” CCSPAOriginal Text CCSPARecommendedRemedies: GuidancefromCommunicationsSecurityEstablishment16 AnappropriateregulatormayprovidetotheCommunicationsSecurityEstablishmentanyinformation,includinganyconfidentialinformation,respectingadesignatedoperator’scybersecurityprogramoranystepstakenundersection15,forthepurposeofrequestingadvice,guidanceorservicesfromtheCommunicationsSecurityEstablishmentinaccordancewiththemandateoftheCommunicationsSecurityEstablishment,inrespectoftheexerciseoftheappropriateregulator’spowersortheperformanceofitsdutiesandfunctionsunderthisAct.

GuidancefromCommunicationsSecurityEstablishment16 AnappropriateregulatormayprovidetotheCommunicationsSecurityEstablishmentanyinformation,includinganyconfidentialinformation,respectingadesignatedoperator’scybersecurityprogramoranystepstakenundersection15,forthepurposeofrequestingadvice,guidanceorservicesfromtheCommunicationsSecurityEstablishmentinaccordancewiththecybersecurityandinformationassurancemandateoftheCommunicationsSecurityEstablishmentassetoutinsection17oftheCSEAct,inrespectoftheexerciseoftheappropriateregulator’spowersortheperformanceofitsdutiesandfunctionsunderthisAct. 2.

ADDafters.23(1)thewords: “(2)Anyinformationsharedinaccordancewithsubsection(1)canonlybeusedbytherecipientpersonforthepurposessetoutinsection5.” Confidential information26(3) Anyconfidentialinformationthatisdisclosedorallowedtobeaccessedundersubsection(1)mustbetreatedasconfidential. Confidential information26(3) Anyconfidentialinformationthatisdisclosedorallowedtobeaccessedundersubsection(1)mustbetreatedasconfidential. Restriction-use:26(4)Informationdisclosedsubjecttosubsections(1)or(2)mustbeusedexclusivelyforpurposesrelatedtotheprotectionofvitalservices,vitalsystemsorcriticalcybersystems. 19

JointCivilSocietySenateSubmissiononBillC-26 References&Resources: Keyresources: ● Full textofBill C-26(aspassedatThirdReadingbytheHouseofCommons)● C-26LegislativeSummary(LibraryofParliament)● Oct2023Civil SocietyJointSubmissiontotheHouseofCommonsStandingCommitteeonPublicSafetyandNational Security(aussi enfrançais)● TestimonytoSECUCommitteefrom: ProfessorAndrewClement,KateRobertson/CitizenLab(Part1, Part2), MattHatfield/OpenMedia, JoannaBaron/CanadianConstitutionFoundation,SharonPolsky/Privacy&AccessCouncil ofCanada● TestimonytoSECUCommitteefromtheOfficeofthePrivacyCommissionerofCanada● Sept2022Civil SocietyJointLetter(PDF)(aussi enfrançais)● CitizenLab/DrChrisParsonsreport:Cybersecuritywillnotthriveindarkness(PDF) Mediacoverage: ● CentreforInternationalGovernanceInnovation(op-edbyMattMalone): AsDrafted, Canada’sNewCybersecurityLawOptsforSecrecyoverSecurity● TheGlobeandMail: Ottawawantsthepowertocreatesecretbackdoorsinournetworkstoallowforsurveillance● iPhoneinCanada: FedsWantSecretBackdoorsforNetworkSurveillance: Experts● NationalObserver/CentreforInternationalGovernanceInnovation(op-edbySharonPolsky):TheRoadtoDigital Hell ispavedwithGoodIntentions● TheHub: Trudeaupromisedradical transparency.

Instead, hehasexacerbatedclosedgovernment(op-edbyMattMalone)● MichaelGeistPodcast: InterviewwithCitizenLab’sKateRobertsononBill C-26● GlobalNews: ContentiousLiberal plantooverhaul cybersecurityfacesmorescrutiny● CanadianPress: Federal cybersecuritybill threatensprivacy, transparency, civil societygroupssay(JimBronskill)● NewsForum-CanadianJustice: Bill C-26, Cybersecurity&Civil Liberties(HostChristineVanGeyninterviewsDrBrendaMcPhail(CCLA)andOpenMedia’sRosaAddario)● CTVNewsPowerPlay: InterviewwithDrChrisParsons● CanadianPress: Liberal cybersecuritybill a'badlaw' thatmustbeamended, researchreportwarns(JimBronskill)● ITWorldCanada: ProposedtelecomcybersecuritylawgivesCanadiangovernmenttoomuchsecretpower: Researcher● PolicyOptions: Don’tgiveCSEmorepowersuntil itsubmitstoeffectivereview(DrChrisParsons)● HillTimes: Canadians’ privacycouldtakeaserioushitthiscominglegislativesession(KenRubin)● TorontoStar(Op-EdbyOpenMedia): MPsmustsaynotoagencyrequestforpowerstospyonyourbankandtravel records 20

Document details

Collection	Senate Committees
Citation	SECD / Brief / 2024-11-13_secd_c-26_brief_ccla_e
Type	committee
Volume / chapter	441 / Brief / 2024-11-13_secd_c-26_brief_ccla_e
Language	en
Format	pdf
Source	COMM_SEN
Identifier	543be013c5d005e7ae9e98894d107a7e3a78cd0a

Source file is stored in the law ingest library (pdf).