JointCivilSocietySenateSubmissiononBillC-26 JointCivil SocietySenateSubmissiononBill C-26 CanadianCivil LibertiesAssociationCanadianConstitutionFoundationInternational Civil LibertiesMonitoringGroupLiguedesDroitsetLibertésNational Council ofCanadianMuslimsOpenMediaPrivacyandAccessCouncil ofCanadaProfAndrewClementDr.

BrendaMcPhail TableofContents: ExecutiveSummary: 2 Recommendation1:Prohibitthegovernmentfromunderminingencryptionandcommunicationssecurity 4Overview: 4Recommendation: 5 Recommendation2:Ensurethatgovernmentorderscannotremainsecretindefinitely 7Overview: 7Recommendation: 8 Recommendation3:FixBill C-26’sseriousprivacyfailings 11Overview: 113.1-Ensurethatpriorjudicial approval isrequired, exceptingenuinelyexigentcircumstances, toobtainconfidential information: 123.2-ResolvetheinconsistencybetweentheCCSPAandtheTelecommunicationsActregardingthehandlingofpersonal information, includingde-identifiedinformation: 133.3-EnsurethatDataRetentionPeriodsareattachedtotelecommunicationsproviders’dataandtoforeigndisclosuresofinformation: 14 Recommendation4:RestricttheCSEtousinginformationobtainedunderBillC-26exclusivelyforcybersecurityandinformationassurancepurposes 17Overview: 17Recommendation: 18 References&Resources: 20 1

JointCivilSocietySenateSubmissiononBillC-26 ExecutiveSummary: HonourableSenators, Asorganizationsandindividualscommittedtoupholdingcivillibertiesandthefundamentalrighttoprivacy,wesharetheGovernmentofCanada’sobjectiveofstrengtheningcybersecurityacrossthepublicandprivatesectors,andsupportingeveryoneinCanadatobebetterabletoprotectthemselvesagainstcyberattacks.

Atthesametime,however,thecurrentformofBill C-26, AnActrespectingcybersecurity,amendingtheTelecommunicationsActandmakingconsequential amendmentstootherActs(“BillC-26”hereafter),containssignificantflawsthatmaycompromisecivillibertiesandcybersecurity —and,therefore,nationalsecurity. Thereisnoreasonwhycybersecurityshouldcomeatthecostofcivilliberties.Indeed,publictrustisessentialforcybersecuritytobeasuccess,especiallyatatimewhenpublictrustindemocraticinstitutionsiserodinginCanadaandacrosstheglobe.Abillwhichfailsthedemocraticlegitimacytestwillfailtostrengthencybersecurity.

WefirstitemizedourconcernsinaSeptember2022jointlettertoformerPublicSafetyMinisterMarcoMendicino,andwereencouragedtohearthemreflectedbyMembersofParliamentfromallpartiesthroughoutBillC-26’s2ndReadingdebate. WefollowedupbysubmittingadetailedpackageofRecommendedRemedies(English,Francais)toMPsontheHouseofCommonsStandingCommitteeonPublicSafetyandNationalSecurity(SECU).Severalofustestifiedatthesubsequenthearingstoprovidelegislatorswithadditionalinsights.

Throughoutthiswork,wedrewfromtheexpertfindingsofDr.ChristopherParsons,assetoutinhisOctober2022reportCybersecurityWill NotThriveinDarkness:ACritical AnalysisofProposedAmendmentsinBill C-26totheTelecommunicationsAct,whichwaspublishedbytheCitizenLabattheUniversityofTorontoinOctober2022. WhiletheworkanddedicationofSECUCommitteemembersandotherMPsfromacrossthepoliticalspectrumhaveresolvedsomeofthecivillibertiesconcernsassociatedwiththelegislation,severalsignificantandoutstandingissuesremainoutstanding.

Giventhatthereremainseveral areasofseriousconcern,andtheconstitutionalroleoftheSenate,webelievethatyouhaveacriticalroletoplayinensuringthatBillC-26deliversstrongcybersecurity,whileprotectingprivacy,ensuringaccountability,andupholdingtherightsofeveryoneinCanada. Werespectfullyhighlightthefollowingfourareasasprioritiesforyourconsideration: 2

JointCivilSocietySenateSubmissiononBillC-26 BillC-26:PriorityRecommendations 1. Prohibitthegovernmentfromunderminingencryptionandcommunicationssecurity 2. Ensurethatgovernmentorderscannotremainsecretindefinitely 3. FixBill C-26’sseriousprivacyfailings 4. RestricttheCSEandothergovernmentagenciestousinginformationobtainedunderBill C-26exclusivelyforcybersecurityandinformationassurancepurposes Inwhatfollowsbelow,weprovidemoredetailonthesepriorityrecommendations.WelookforwardtodiscussingtheserecommendationsfurtherwithmembersoftheSenatewhenyourscrutinyofBillC-26commences. 3

JointCivilSocietySenateSubmissiononBillC-26 Recommendation1:Prohibitthegovernmentfromunderminingencryptionandcommunicationssecurity Overview: BillC-26,aspassedbytheHouseofCommons,containsadangerousloophole.Specifically,thenewministerialpowerssetoutinsection15.2(2)oftheTelecommunicationsActamendmentscouldbeusedtodeliberatelyorinadvertentlycompromisethesecurityoftelecommunicationsnetworksthatpeople,governments,andbusinessesacrossCanada(andbeyond)relyuponeveryday.

Thisisespeciallythecaseregardings.15.2(2)(l)whichgivesthegovernmentthepowertorequiretelecommunicationsprovidersto“implementspecifiedstandardsinrelationtoitstelecommunicationsservices, telecommunicationsnetworksortelecommunicationsfacilities." Thedangeristhatsuchabroadly-wordedpowercouldbeusedtocompelproviderstoadoptstandardswhichweaken,ratherthanstrengthen,encryptionandprivacy.Ascurrentlydrafted,thestatutorylanguageendangersthefreedomofpeopleinCanadatocommunicateprivatelywithoneanother,orbusinessestosafelyengageinnationalandinternationalcommerce,orgovernmentsandelectedrepresentativestoenjoyprivatecommunications.

Cybersecurityexperts,inCanadaandelsewhere,havecautionedthatthecurrentstatutorylanguageendangersCanada’seconomy,itsinternationalrelations,andthefundamentalrighttoprivacyofpeopleacrossCanada: ● WritingforTheGlobe&Mail,CitizenLab’sKateRobertsonandRonDeibertwarnthatthe“secretive, encryption-breakingpowers”inBillC-26“threatentheonlinesecurityofeveryoneinCanada,”andthatthebill “empowersgovernmentofficialstosecretlyordertelecommunicationscompaniestoinstall backdoorsinsideencryptedelementsinCanada’snetworks.” ● InhistestimonytotheparliamentarycommitteestudyingBillC-26,EricSmith,SeniorVice-PresidentattheCanadianTelecommunicationsAssociation,referencedthe“verybroad”order-makingpowersinBillC-26,statingthat“Itcouldberequiringyounotnecessarilytotakeoutequipmentfromyourinfrastructure, buttoputcertainequipmentintoyourinfrastructure, ortocomplywithcertainstandards.

Itcouldbeweakeningencryption, oritcouldberequiringyoutointerceptcommunications." ● CitingtheUSasanexampleofgovernmentoverreachthatCanadashouldavoid,theElectronicFrontierFoundationstatedthat"theU.S. experienceoffersacautionarytaleofwhatcanhappenwhenagovernmentgrantsitselfbroadpowerstomonitoranddirecttelecommunicationsnetworks, absentcorrespondingprotectionsforhumanrights,”andwarnedthat"withoutadequatesafeguards, Bill C-26couldopenthedoortosimilarpracticesandorders." 4

JointCivilSocietySenateSubmissiononBillC-26 Despitehavingreceivedmultiplebriefs(e.g. here, here, here,andhere)andhearingfromseveralwitnesses(e.g. here, here, here,andhere)onthistopic,SECUdidnotconsiderthematterduringitsclause-by-clausereviewofBillC-26.TheHouseofCommonsalsoeschewedtheopportunitytodosoduringReportStage,despiteurgingsthatParliamentariansaddressthem.Instead,BillC-26wasrushedthroughReportStagewithoutanydebate. Thisfliesinthefaceofthegovernment’sunequivocalstatementsthroughouttheSECUCommitteereviewthatBillC-26’spurposeisnetworksecurity,notsurveillance.

Recommendation: ThedangertoCanadians’ communicationssecuritycanbeaddressedsimply,bymakingitexplicitinstatutewhatkindsofstandardsarewithinandbeyondthescopeofthelegislation: TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedy: Scopeandsubstance15.2(2. 1) Theprovisionsofanordermadeundersubsection(1)or(2)must,inscopeandsubstance,bereasonabletothegravityofthethreatofinterference,manipulation,disruptionordegradation.

Forgreatercertainty15.2(2. 2) Forgreatercertainty,despitesubsection(2),theMinisterisnotpermittedtoorderatelecommunicationsserviceprovidertointerceptaprivatecommunicationoraradio-basedtelephonecommunication,asthosetermsaredefinedinsection183oftheCriminalCode. Scopeandsubstance15.2(2. 1) Theprovisionsofanordermadeundersubsection(1)or(2)must,inscopeandsubstance,bereasonabletothegravityofthethreatofinterference,manipulation,disruptionordegradation.

Forgreatercertainty15.2(2. 2) Forgreatercertainty,despitesubsection(2),theMinisterisnotpermittedtoorderatelecommunicationsserviceprovidertointerceptaprivatecommunicationoraradio-basedtelephonecommunication,asthosetermsaredefinedinsection183oftheCriminalCode. Forgreatercertainty15.2(2.3)Forgreatercertainty, despitesubsection(2), theMinisterisnotpermittedtomakeanorderthatwouldcompromisetheconfidentiality, availability, orintegrityofatelecommunicationsfacility, telecommunicationsservice, ortransmissionfacility.

Thisrecommendationismeanttoensurethatthegovernmentisempoweredtoissueorderscompellingtelecommunicationsproviderstostrengthentheconfidentialityandsecurityoftheirnetworks,butnottoweakenthem. Thisamendmentisintendedtopreventthegovernmentfromorderingordemandingthattelecommunicationsserviceprovidersdeployorenable(orhavedeployedorenabled) 5

JointCivilSocietySenateSubmissiononBillC-26 lawful-accessrelatedcapabilitiesorpowersintheserviceof‘securing’ infrastructurebywayofadoptingastandard.Ifthegovernmentwishestopursueenhancedlawfulinterceptionpowers,itshoulddosobywayofseparatelegislativeprocesses. AcrossCanada,peopleandbusinessesrelyonthestrengthandconfidentialityofencryptednetworkstokeeptheircommunicationssafeandsecure.ThecriticalimportanceofsecurecommunicationsisreinforcedbythefactthattheCommunicationsSecurityEstablishment(CSE)recentlyintroducedend-to-endencryptiontoCanada’sTopSecretNetwork(CTSN)—seepage9ofCSE’srecentannual report.

WhetheritistheCSE,alargecorporation,asmallbusiness,politicalrepresentatives,orneighboursexchangingnewsandviews,everybodyinCanadamustbeabletohavetrustinthesecurityoftheircommunications.Thisrecommendationwillensurepreciselythat. 6

JointCivilSocietySenateSubmissiononBillC-26 Recommendation2:Ensurethatgovernmentorderscannotremainsecretindefinitely Overview: ThecurrentlanguageinBillC-26allowsthegovernmenttokeepsecretanyordermadetotelecommunicationsproviders,andtooperatorsdesignatedundertheCritical CyberSystemsProtectionAct(CCSPA).UnderthecurrentwordingofBillC-26,asamendedbytheHouseofCommons,telecommunicationsprovidersanddesignatedoperatorsareprohibitedfromevendisclosingthefactthatanorderwasissued,letaloneitscontents.

Weappreciatethatsecrecymightbewarrantedincertaincircumstances;butsecrecyshouldneitherbethedefaultnorbepermittedtoremaininplaceindefinitely.Inademocracy,thegovernmentmustensurepeoplecanunderstandhowitexercisesitscybersecurityandotherpowers,howoften,andtowhateffect,toensurethatdecision-makerscanbeproperlyheldtoaccount.

TheconcernaddressedbythisRecommendationaroseduringtheSECUCommittee’sclause-by-clausereview,whenBlocQuebecoisMPKristinaMichaudproposedanamendment—basedcloselyonoursubmissiontothecommittee—whichwouldhaverequiredanorderfromtheFederalCourtasacheck-and-balanceagainstgovernmentoverreach,soastoensurethegovernmentcannotconcealdisproportionatelyintrusiveactionsundercoverofsecrecy. Governmentofficialsresistedthisproposedamendment,andarguedthatit“couldleadtoefficiencyrisks.

Forexample, aFederal Courtprocesswouldtakeatleastafewweeks.”Tosupporttheirargument,theypointedtoseriouscybersecurityincidentsinwhichurgentgovernmentactionhadbeenrequired,andassertedthattheproposedamendmentmightimpedeemergencyresponses.

MPJenniferO’Connell,thegovernment’sparliamentarysecretaryforcybersecurity,echoedMPMichaud’sconcerns.Sheproposedanalternativeamendmentrequiringnotificationofallorders,includingconfidentialones,totheNationalSecurityandIntelligenceCommitteeofParliamentarians(NSICOP)andtheNationalSecurityandIntelligenceReviewAgency(NSIRA).Thegovernment’samendmentpassed,andisnowreflectedins.15.22oftheTelecommunicationsAct,ands.20(4)oftheCCSPA.

Althoughthegovernment’samendmentwasanimportantandpositivestep, itfallsfarshortofaddressingthecoreproblem:thepotential forgovernmentcybersecurityorderstoremainsecretindefinitely, withoutthevalidityofsuchsecrecyeverbeingreviewedbyacourt. 7

JointCivilSocietySenateSubmissiononBillC-26 Recommendation: Weacknowledgetheconcernthattherewillbeoccasionswhenthegovernmentneedstotakeswiftcybersecurityactions,andmaydeterminethatthedelayrequiredtoobtainaFederalCourtorderisexcessiveinthecircumstances.Accordingly, wesuggestarevisedamendmenttorecognizetheneedforextraordinaryactioningenuinelyexigentcircumstances,whichalsoensuresacourtwouldreviewthevalidityofsecrecyofallorders,within90daysofeachsuchorderbeingissued.

Thisrecommendationwouldimposea90-daytimelimitontheconfidentialityprovisionsofallorders,andanyextensionwouldrequirethegovernmentbringinganapplicationtotheFederalCourt: TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedies: Non-disclosure15.1(2)Theordermayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson.

Non-disclosure15.1(2)(a)Theordermayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson,foraperiodofupto90daysafterthedayonwhichitismade. 15.1(2)(b)(i)TheGovernorinCouncilmaybringanapplicationtotheFederalCourtforanordertoextendtheperiodduringwhichthedisclosureofsomeorallofthecontentsoftheorderissuedundersubsection(1)isprohibited.TheFederalCourtmaymakeanordertothateffectwhereitissatisfiedthattherearereasonablegroundstobelievethatthedisclosureofsomeoralloftheorderwouldbeinjurioustointernationalrelations,nationaldefenceornationalsecurityorendangerthesafetyofanyperson. 15.1(2)(b)(ii)Thejudge,inconsiderationoftheprinciplesoffairnessandnaturaljustice,shallappointaspecialcounselfromthelistofpersonsreferredtoinsubsection85(1)oftheImmigrationandRefugeeProtectionActforthepurposesofcontestingtheGovernorinCouncil'sapplication.

Non-disclosure15.2(3)Anordermadeundersubsection(1)or(2)mayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson. Non-disclosure15.2(3)(a)Anordermadeundersubsection(1)or(2)mayalsoincludeaprovisionprohibitingthedisclosureofitsexistence,orsomeorallofitscontents,byanyperson,foraperiodofupto90daysafterthedayonwhichitismade. 15.2(3)(b)(i)TheMinistermaybringan 8

JointCivilSocietySenateSubmissiononBillC-26 applicationtotheFederalCourtforanordertoextendtheperiodduringwhichthedisclosureofsomeorallofthecontentsoftheorderissuedundersubsection(1)or(2)isprohibited.TheFederalCourtmaymakeanordertothateffectwhereitissatisfiedthattherearereasonablegroundstobelievethatthedisclosureofsomeoralloftheorderwouldbeinjurioustointernationalrelations,nationaldefenceornationalsecurityorendangerthesafetyofanyperson. 15.2(3)(b)(ii)Thejudge,inconsiderationoftheprinciplesoffairnessandnaturaljustice,shallappointaspecialcounselfromthelistofpersonsreferredtoinsubsection85(1)oftheImmigrationandRefugeeProtectionActforthepurposesofcontestingtheMinister’sapplication.

AsimilarsituationappliestotheCritical CyberSystemsProtectionAct(CCSPA),whichallowsthegovernmenttokeepsecretanyordermadetodesignatedoperators.Thisisparticularlyproblematicgiventhereisnoautomaticpublicnotificationmechanismforneworders.Again,whiletherearecertainlysituationsinwhichsecrecymightbeappropriate,secrecyshouldnotbethedefaultinarobustdemocracysuchasCanada’s.

Thefollowingsuggestedamendmentwouldpermitdesignatedoperatorstodisclosetheexistenceofadirection,butnotitscontent,excepttotheextentnecessarytocomplywiththedirection: CCSPACurrentText CCSPARecommendedRemedies: Prohibitionagainstdisclosure24Everydesignatedoperatorthatissubjecttoacybersecuritydirectionisprohibitedfromdisclosing,orallowingtobedisclosed,thefactthatacybersecuritydirectionwasissuedandthecontentofthatdirection,exceptinaccordancewithsection25.

Prohibitionagainstdisclosure24Everydesignatedoperatorthatissubjecttoacybersecuritydirectionisprohibitedfromdisclosing,orallowingtobedisclosed, thefactthatacybersecuritydirectionwasissuedandthecontentofthatdirection,exceptinaccordancewithsection25. Disclosure—whenallowed25

(1) Adesignatedoperatorthatissubjecttoacybersecuritydirectionmaydisclosethefactthatthedirectionwasissuedanditscontentonlytotheextentnecessarytocomplywiththedirection. Disclosure—whenallowed25

(1) Adesignatedoperatorthatissubjecttoacybersecuritydirectionmaydisclosethefactthatthedirectionwasissuedanditscontentonlytotheextentnecessarytocomplywiththedirection. 9

JointCivilSocietySenateSubmissiononBillC-26 Finally,theStandingJointCommitteefortheScrutinyofRegulationsplaysakeyroleinCanada’sdemocraticprocess.BillC-26shouldbeamendedsuchthattheStandingJointCommitteefortheScrutinyofRegulationsisabletoobtain,assess,andrenderaverdict,whichmustpromptlybemadepublic,onanyregulationsthatarepromulgatedundertheproposeddraftreformstotheTelecommunicationsActandCanadaCyberSystemsProtectionAct.

TheCommitteeshouldalsobeempoweredtoobtain,assess,andrenderaverdict,whichmustpromptlybemadepublic,onregulationspertainingtotheTelecommunicationsActandthataremodifiedpursuanttos.18oftheStatutoryInstrumentsAct.

ThefollowingclausesinBillC-26,whichexemptthelegislationfromtheStatutoryInstrumentsAct,shouldbeeitherdeleted,oramendedtomakeclearthattheStatutoryInstrumentsActapplies: ● Section15.3(3)oftheTelecommunicationsActamendments● Sections22(1),34(2),36(3),43(2),45(3),52(2),54(3),61(2),63(3),70(3),73(4),80(2),and82(3) oftheCCSPA Incorporatingtheaboverecommendationswillgreatlyimprovetransparencyand,accordingly,publicconfidenceandtrustinhowthegovernmentusesthesweepingnewpowersitisgrantingitself. 10

JointCivilSocietySenateSubmissiononBillC-26 Recommendation3:FixBill C-26’sseriousprivacyfailings Overview: SinceBillC-26wasfirstrevealedinJune2022,privacyhascontinuedtobeoneofourforemostconcerns.InourSeptember2022JointLettertothethenPublicSafetyMinisterMarcoMendicino,wewarnedthat: “Bill C-26empowersthegovernmenttocollectbroadcategoriesofinformationfromdesignatedoperators, withinanytimeandsubjecttoanyconditions.

Thismayenablethegovernmenttoobtainidentifiableandde-identifiedpersonal informationandsubsequentlydistributeittodomestic, andperhapsforeign, organizations.” WerecognizethatsomeprogresshasbeenmadeonthisfrontasBillC-26progressedthroughtheHouseofCommons,suchas: ● Telecommunicationsproviders,whichretainvastquantitiesofCanadians’ mostsensitiveinformation,cannowdefinepersonalandde-identifiedinformationas“confidential”—withtheeffectofimposingsignificantlystrongerprotectionsforitshandling,storage,andsafeguarding. ● ThePrivacyActnowexplicitlyappliestotheextensiveinformation-sharingprovisionsinboththeTelecommunicationsActamendmentsandtheCCSPA.

However,Canadians’ privacycontinuestobeputinjeopardyasaresultofBillC-26’sstatutorylanguage.Someofthemostglaringproblemsare: ● Thegovernmentcanstilldiscloseconfidentialinformation,obtainedfromtelecommunicationsproviders,toanyone,withoutfirstobtaininganorderfromtheFederalCourt.Thegovernmentarguedthatthispowerwasrequiredtoavoiddelayedresponsestoemergencies;however,ourproposedamendment(setoutbelow),amelioratestheseconcerns. ● TheSECUCommitteecreatedalegislativeinconsistencyinfailingtopassanamendmentthatwouldhaveexplicitlydefinedpersonalandde-identifiedinformationas“confidential”fortheCCSPA,asitdidfortheTelecommunicationsAct. ● TheSECUCommitteehadsoughttoprotectCanadians' privacybylimitingdataretentionperiods(ref: amendmentbyKristineMichaud).However,thisamendmentwasoverturnedwithoutdebateattheReportStage,withtheeffectofenablingpotentiallyindefiniteretentionofCanadians' personalinformation 11

JointCivilSocietySenateSubmissiononBillC-26 WestronglyencourageyoutosystematicallyaddressthesefundamentalshortcomingsduringyourstudyofBillC-26,andimplementthefollowingrecommendations: 3.1-Ensurethatpriorjudicial approval isrequired, exceptingenuinelyexigentcircumstances, toobtainconfidential information: Ascurrentlydrafted,BillC-26allowstheMinistertorequirethedisclosureofconfidentialinformation—includingpersonalandde-identifiedinformation—fromdesignatedproviders.ThissweepingpowermustbesubjecttochecksandbalancestopreventtheMinisterfromcollectingandsubsequentlydisclosingpotentiallyinjuriousinformationwithoutfirstobtaininganorderfromtheFederalCourt.Otherwise,businessesandindividualsacrossCanadawillbeexposedtotheseriousriskofhavingtheirmostsensitiveinformationinappropriatelydisclosed.

Thelegislationshouldbeamendedsothat—beforethegovernmentcancompelatelecommunicationsprovidertodisclosepersonalorde-identifiedinformation—itmustfirstobtainarelevantjudicialorderfromtheFederalCourt,stipulatingthattheinformationcollectedpursuanttosuchorderistobeusedexclusivelyforthepurposesofmaking,amending,orrevokinganorderunders.15.1or15.2oraregulationunderparagraph15.8(1)(a),orofverifyingcomplianceorpreventingnon-compliancewithsuchanorderorregulation.

Recognizingthattherewillbeoccasionsinwhichinformationmustbedisclosedonanurgentbasis,ourrecommendationsincludeanaccommodationforgenuinelyexigentcircumstances,includingprovisionforretroactivereviewbytheFederalCourt.

TelecommunicationsActOriginal Text TelecommunicationsActRecommendedRemedies: 15.5(3)(c)thedisclosureisnecessary,intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulationordisruption. 15.5(3)(c)onapplicationtotheFederalCourt,ajudgeissatisfiedbyinformationonoaththattherearereasonablegroundstobelievethatthedisclosureisnecessary, intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem, includingagainstthethreatofinterference,manipulationordisruption. 15.5(3)(d)iftheconditionssetoutinsubsection(c)forobtainingaFederalCourtorderexist,butbyreasonofexigentcircumstancesinvolvinganimminentneedtosecuretheCanadiantelecommunicationssystemagainstthethreatofinterference,manipulation,ordisruption,itwouldbeimpracticabletoobtainaFederalCourtorder.Insuchcircumstances,theMinistershallwithin30daysmakeanapplicationtotheFederalCourt,andprovideinformationunderoathjustifyingthedisclosure. 12

JointCivilSocietySenateSubmissiononBillC-26 3.2-ResolvetheinconsistencybetweentheCCSPAandtheTelecommunicationsActregardingthehandlingofpersonal information, includingde-identifiedinformation: Asnotedabove,theTelecommunicationsActnowexplicitlydefinespersonalandde-identifiedinformationas“confidential”ins.15.5(1)(d).Thisisacriticallyimportantimprovementovertheoriginaldraft. However,thelegislativewordingshouldalsomakeclearthatpersonalinformationincludesde-identifiedinformation,becausethedefinitionof“personalinformation”carriesimportantPrivacyActprotections. TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedies: 15. 5

(1) Apersonwhoprovidesanyofthefollowinginformationundersection15. 4maydesignateitasconfidential: (

a) informationthatisatradesecret; (

b) financial,commercial,scientificortechnicalinformationthatisconfidentialandthatistreatedconsistentlyinaconfidentialmannerbythepersonwhoprovidedit; (

c) informationthedisclosureofwhichcouldreasonablybeexpectedto (

i) resultinmaterialfinanciallossorgaintoanyperson, (ii) prejudicethecompetitivepositionofanyperson,or (iii) affectcontractualorothernegotiationsofanyperson;or (

d) personalinformationandde-identifiedinformation. 15. 5

(1) Apersonwhoprovidesanyofthefollowinginformationundersection15. 4maydesignateitasconfidential: (

a) informationthatisatradesecret; (

b) financial,commercial,scientificortechnicalinformationthatisconfidentialandthatistreatedconsistentlyinaconfidentialmannerbythepersonwhoprovidedit; (

c) informationthedisclosureofwhichcouldreasonablybeexpectedto (

i) resultinmaterialfinanciallossorgaintoanyperson, (ii) prejudicethecompetitivepositionofanyperson,or (iii) affectcontractualorothernegotiationsofanyperson;or (

d) personalinformationandincludingde-identifiedinformation.

Definitions(1. 1) Thefollowingdefinitionsapplyinparagraph(1) (d). de-identify meanstomodifypersonalinformationsothatanindividualcannotbedirectlyidentifiedfromit,thoughariskofthe

Definitions(1. 1) Thefollowingdefinitionsapplyinparagraph(1) (d). de-identify meanstomodifypersonalinformationsothatanindividualcannotbedirectlyidentifiedfromit,thoughariskofthe 13

JointCivilSocietySenateSubmissiononBillC-26 individualbeingidentifiedremains. (dépersonnaliser) personal information hasthesamemeaningasinsection3ofthePrivacyAct. (renseignementspersonnels) individualbeingidentifiedremains. (dépersonnaliser) personal information hasthesamemeaningasinsection3ofthePrivacyAct. (renseignementspersonnels) (1.2)Anyinformationprovidedundersection15.4thatispersonalinformation,includinganyde-identifiedinformation,shallbedeemedtobeconfidential.

Furthermore,fortheavoidanceofdoubt,theCCSPAshouldbebroughtintolinewiththerevisedTelecommunicationsActinproactivelydefiningpersonalinformation,includingde-identifiedinformation,asconfidential: CCSPACurrentText CCSPARecommendedRemedies:

Definitions confidential information meansanyinformationobtainedunderthisActinrespectofacriticalcybersystemthat (

a) concernsavulnerabilityofanydesignatedoperator’scriticalcybersystemorthemethodsusedtoprotectthatsystemandthatisconsistentlytreatedasconfidentialbythedesignatedoperator; (

b) ifdisclosedcouldreasonablybeexpectedtoresultinmaterialfinanciallossorgainto,orcouldreasonablybeexpectedtoprejudicethecompetitivepositionof,adesignatedoperator;or (

c) ifdisclosedcouldreasonablybeexpectedtointerferewithcontractualorothernegotiationsofadesignatedoperator. (renseignementsconfidentiels)

Definitions confidential information meansanyinformationobtainedunderthisActinrespectofacriticalcybersystemthat (

a) concernsavulnerabilityofanydesignatedoperator’scriticalcybersystemorthemethodsusedtoprotectthatsystemandthatisconsistentlytreatedasconfidentialbythedesignatedoperator; (

b) ifdisclosedcouldreasonablybeexpectedtoresultinmaterialfinanciallossorgainto,orcouldreasonablybeexpectedtoprejudicethecompetitivepositionof,adesignatedoperator;or (

c) ifdisclosedcouldreasonablybeexpectedtointerferewithcontractualorothernegotiationsofadesignatedoperator. (renseignementsconfidentiels) (d)informationthatispersonalinformation,includingde-identifiedinformation. Finally,personalinformation,includingde-identifiedinformation,shouldalwaysbedeemedtobeconfidential,ratherthanthatdecisionbeinglefttothediscretionoftheentityprovidingit.ThisshouldbeaccomplishedbyadoptingRecommendation10ofCitizenLab’sSubmissiontothisCommittee: 14

JointCivilSocietySenateSubmissiononBillC-26 TelecommunicationsActCurrentText TelecommunicationsActRecommendedRemedies: Exception15.5(3) Informationthatisdesignatedasconfidentialmaybedisclosed,orbepermittedtobedisclosed,if (

a) thedisclosureisauthorizedorrequiredbylaw; (

b) thepersonwhodesignatedtheinformationasconfidentialconsentstoitsdisclosure;or (

c) thedisclosureisnecessary,intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulationordisruption. Exception15.5(3) Informationthatisdesignatedasconfidentialmaybedisclosed,orbepermittedtobedisclosed,if (

a) thedisclosureisauthorizedorrequiredbylaw; (

b) thepersonwhodesignatedtheinformationasconfidentialconsentstoitsdisclosure,orinthecaseofpersonalorde-identifiedinformation,thepersontowhomtheinformationrelatesconsentstoitsdisclosure. (

c) thedisclosureisnecessary,intheMinister’sopinion,tosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulationordisruption. 3.3-EnsurethatDataRetentionPeriodsareattachedtotelecommunicationsproviders’ dataandtoforeigndisclosuresofinformation: BillC-26mustbeamendedtomakeclearthatinformationobtainedfromtelecommunicationsproviders,oroperatorsdesignatedbytheCCSPA,willberetainedonlyforaslongasnecessarytomake,amend,orrevokeanorderundersection15.1or15.2oraregulationunderparagraph15.8(1)(a)oftheTelecommunicationsAct,orSection20oftheCCSPA,ortoverifythecomplianceorpreventnon-compliancewithsuchanorderorregulation.

AnamendmentapplyingdataretentionperiodstoinformationcollectedfromdesignatedoperatorsundertheCCSPAthatwasinitiallypassedbytheSECUcommitteeduringitsclause-by-clausereviewwaslaterreversed—withoutdebate—atReportStage. Thisbegsthequestion—ifthegovernmentclaimsitneedstocollectinformationforthespecificpurposeofmakingorders,whyisitopposedtorestrictingitsretentiontotheperiodforwhichitisnecessaryforthatpurpose?

WeurgeyourcommitteetoensurethatdataretentionperiodsapplytotheTelecommunicationsActandtheCCSPA,andthatsuchclausesalsoapplytoanyinformationdisclosurestoforeigngovernments,organizations,andentities: RECOMMENDEDREMEDY-TelecommunicationsAct: 15

JointCivilSocietySenateSubmissiononBillC-26 1.

Addafters. 15.7(2)thewords: “DataRetentionPeriods(3)AnyinformationcollectedorobtainedunderthisActwill beretainedonlyforaslongasnecessarytomake, amend, orrevokeanorderundersection15.1or15.2oraregulationunderparagraph15.8(1)(a), ortoverifythecomplianceorpreventnon-compliancewithsuchanorderorregulation. (4)RetentionperiodsshouldbecommunicatedtothepersonfromwhomtheMinister, orpersondesignatedbytheMinisterundersection15.4, hascollectedtheinformation. (5)Anyagreement, memorandumofunderstanding, orarrangementinwritingbetweentheGovernmentofCanadaandthegovernmentofaforeignstate, aninternational organizationofstatesoraninternational organizationestablishedbythegovernmentsofstates, mustincludedataretentionanddeletionclausestoensureitisretainedonlyforaslongasisnecessaryforthepurposessetoutinsubsection(1).” RECOMMENDEDREMEDY-CCSPA: 1.

Addafters. 26(3)thewords: “DataRetentionPeriods(4)AnyinformationcollectedorobtainedunderthisActwill beretainedonlyforaslongasnecessarytomake, amend, orrevokeanorderundersection20, ortoverifythecomplianceorpreventnon-compliancewithsuchanorderorregulation. (5)RetentionperiodsshouldbecommunicatedtothepersonfromwhomtheGovernorinCouncil hascollectedtheinformation. (6)Anyagreement, memorandumofunderstanding, orarrangementinwritingbetweentheGovernmentofCanadaandthegovernmentofaforeignstate, aninternational organizationofstatesoraninternational organizationestablishedbythegovernmentsofstates, mustincludedataretentionanddeletionclausestoensureitisretainedonlyforaslongasisnecessaryforthepurposessetoutinsubsection(1).” 16

JointCivilSocietySenateSubmissiononBillC-26 Recommendation4:RestricttheCSEtousinginformationobtainedunderBill C-26exclusivelyforcybersecurityandinformationassurancepurposes Overview: Initscurrentform,BillC-26wouldauthorizetheCommunicationsSecurityEstablishment(CSE)—Canada’ssignalintelligenceandcybersecurityagency—toobtainandanalyzesecurity-relateddatafromcompaniesthatCanadiansentrustwiththeirmostsensitivepersonalinformation—includingtelecommunicationsproviders,federally-regulatedfinancialinstitutions,energyproviders,andeveryotherentitydesignatedundertheCCSPA.

BillC-26amountstoadramaticexpansionofCSE’sinformationcollectionpowers.Thisisproblematic,becausetheCSE'suseoftheinformationitcollectsiscurrentlynotconstrainedtothecybersecurityaspectofitsmandate,andanyuseswouldbelargelysubjecttoafter-the-factreviewratherthanreal-timeoversight.

ThegovernmentassuresusthattheCSE'snewinformationcollectionpowersarenecessaryforcybersecuritypurposes,butitdoesnotfollowthatitiseithernecessaryorproportionatetousetheseexpandedpowersacrossallaspectsoftheCSE'smandate.AshighlightedinarecentarticlebylawprofessorMattMalone,publishedbytheCentreforInternationalGovernanceInnovation, “ThisdivergesmarkedlyfromthethrustoftheCSE’senablinglegislation, whichseekstoimposegreateraccountabilityovercertainconductthroughpriorauthorizationandreviewobligations.” Inshort,BillC-26riskserodingthecarefulprotectionsintheCommunicationsSecurityEstablishmentActagainstallowingtheCSEinsomeaspectsoftheirmandatefromdirectingactionsatCanadiansorpersonsinCanada,orcollectinginformationthatinterfereswiththereasonableexpectationofprivacyofapersoninCanada,asprotectedbyourCharter.

Thisisnotatheoreticalthreat.ItisclearfromthetestimonyofCSEofficialsduringSECU’sclause-by-clausereviewthattheCSEfullyintendstouseinformationitgathersforbothoffensiveanddefensivepurposes,andalsointendstoshareinformationitcollectswithitsFiveEyespartners. AskedtocommentonaBlocamendmentwhichwouldhaveconstrainedCSE’suseofinformationitgathers,CSE’sStephenBolton(DirectorGeneral,StrategicPolicy)replied: “InformationcollectedbyCSEpursuanttooneaspectofitsmandatecanbeusedbyCSEunderanotheraspectofthemandateaslongasitmeetsspecificconditionssetoutintheCSEAct.

Informationrelatedtosecurityprogramswill enableCSEanditscybercentretogainabetterunderstandingofthesupplychainriskofdesignatedoperatorsaswell astheintentionsofaforeignentityviaitspenetrationintorespectivesectors. 17

JointCivilSocietySenateSubmissiononBillC-26 WithoutbeingabletoleverageCSE'smandateasawhole, CSE'sunderstandingofforeignactors' intentionsagainstourcritical infrastructureandtheproperstrategicmitigationswouldbegreatlydiminished.

AnylimitationwouldalsoreduceCSE'scollaborationwithourFiveEyespartners.” [emphasisadded] Inotherwords,theCSEclaimsthatnotonlyareitsnewinformation-collectionpowersinBillC-26requiredforcybersecuritypurposes,italsoaimstousethemtosupportinternationalrelationswithothernations’ signalsintelligenceagencies.Whileouralliancesareimportant,Canadians’ personalinformationshouldnotbethecointomaintaintheserelations.

TheseriskstoprivacyanddemocraticaccountabilityareexacerbatedbytheCSE’slongtrackrecordoffailingtoembracetransparency.ThisincludestheCSE’sfailuretocooperatewiththeNationalSecurityandIntelligenceReviewAgencyinitsinvestigationsortoactonwithitsrecommendations.

Forexample,theCSEhaspreviouslyrejectedrecommendationsbytheNational SecurityandIntelligenceReviewAgency(NSIRA)thatit“obtainadditional legal adviceonitsinternalsharingofinformationbetweentheforeignintelligenceandcybersecurityaspectsofthemandate, explicitlyinrelationtocompliancewiththePrivacyAct,”claimingin2021thatithadalreadyreceivedlegaladviceonthematterfromtheDepartmentofJustice.

DespiteCSE’s2021refusal,NSIRArepeateditsrecommendationinitsmostrecentreviewpublishedJanuary2024,findingthat“CSE’sinternal sharingofinformationbetweentheFIandcybersecurityaspectsofthemandatehasnotbeensufficientlyexaminedforcompliancewiththePrivacyAct.” Inshort,aspresentlydrafted,C-26riskscontinuingasituationwheretheCSEinterpretsitsmandates--nowsuperchargedwithevenmoreCanadians’ personalinformation--inmannersthathavebeenfoundnon-compliantwiththePrivacyActbytheirreviewer.TheSenatehasaroleandobligationtopreventsuchamishandlingofCanadians’ oftenmostsensitiveinformation,especiallygiventheCSE’slongtrackrecordoffailingtocooperatewithitsreviewagencies.

Recommendation: BillC-26mustbeamendedtoensurethatallgovernmentdepartmentsandagencies,includingtheCSE,useinformationobtainedunderBillC-26exclusivelyforthecybersecurityandinformationassuranceactivitiesforwhichtheinformationiscollected. Suchinformationshouldnotbepermittedtobeusedforadditionalpurposes,suchassignalsintelligenceandforeignintelligenceactivities,cross-departmentassistanceunrelatedtocyber-security,oractiveordefensivecyberoperations.Theserestrictionsshouldapplytoallagencies,includingbutnotlimitedtothoseunderthepurviewoftheMinisterofPublicSafetyandEmergencyPreparedness. 18

JointCivilSocietySenateSubmissiononBillC-26 TelecommunicationsActOriginal Text TelecommunicationsActRecommendedRemedies: 1.

ADDafters.15.6(2)thewords: “15.6(3)Anyinformationsharedinaccordancewithsection15.6canonlybeusedbytherecipientpersonforpurposesexclusivelyrelevanttosecuringtheCanadiantelecommunicationssystemagainstthethreatofinterference, manipulationordisruption.” CCSPAOriginal Text CCSPARecommendedRemedies: GuidancefromCommunicationsSecurityEstablishment16 AnappropriateregulatormayprovidetotheCommunicationsSecurityEstablishmentanyinformation,includinganyconfidentialinformation,respectingadesignatedoperator’scybersecurityprogramoranystepstakenundersection15,forthepurposeofrequestingadvice,guidanceorservicesfromtheCommunicationsSecurityEstablishmentinaccordancewiththemandateoftheCommunicationsSecurityEstablishment,inrespectoftheexerciseoftheappropriateregulator’spowersortheperformanceofitsdutiesandfunctionsunderthisAct.

GuidancefromCommunicationsSecurityEstablishment16 AnappropriateregulatormayprovidetotheCommunicationsSecurityEstablishmentanyinformation,includinganyconfidentialinformation,respectingadesignatedoperator’scybersecurityprogramoranystepstakenundersection15,forthepurposeofrequestingadvice,guidanceorservicesfromtheCommunicationsSecurityEstablishmentinaccordancewiththecybersecurityandinformationassurancemandateoftheCommunicationsSecurityEstablishmentassetoutinsection17oftheCSEAct,inrespectoftheexerciseoftheappropriateregulator’spowersortheperformanceofitsdutiesandfunctionsunderthisAct. 2.

ADDafters.23(1)thewords: “(2)Anyinformationsharedinaccordancewithsubsection(1)canonlybeusedbytherecipientpersonforthepurposessetoutinsection5.” Confidential information26(3) Anyconfidentialinformationthatisdisclosedorallowedtobeaccessedundersubsection(1)mustbetreatedasconfidential. Confidential information26(3) Anyconfidentialinformationthatisdisclosedorallowedtobeaccessedundersubsection(1)mustbetreatedasconfidential. Restriction-use:26(4)Informationdisclosedsubjecttosubsections(1)or(2)mustbeusedexclusivelyforpurposesrelatedtotheprotectionofvitalservices,vitalsystemsorcriticalcybersystems. 19

JointCivilSocietySenateSubmissiononBillC-26 References&Resources: Keyresources: ● Full textofBill C-26(aspassedatThirdReadingbytheHouseofCommons)● C-26LegislativeSummary(LibraryofParliament)● Oct2023Civil SocietyJointSubmissiontotheHouseofCommonsStandingCommitteeonPublicSafetyandNational Security(aussi enfrançais)● TestimonytoSECUCommitteefrom: ProfessorAndrewClement,KateRobertson/CitizenLab(Part1, Part2), MattHatfield/OpenMedia, JoannaBaron/CanadianConstitutionFoundation,SharonPolsky/Privacy&AccessCouncil ofCanada● TestimonytoSECUCommitteefromtheOfficeofthePrivacyCommissionerofCanada● Sept2022Civil SocietyJointLetter(PDF)(aussi enfrançais)● CitizenLab/DrChrisParsonsreport:Cybersecuritywillnotthriveindarkness(PDF) Mediacoverage: ● CentreforInternationalGovernanceInnovation(op-edbyMattMalone): AsDrafted, Canada’sNewCybersecurityLawOptsforSecrecyoverSecurity● TheGlobeandMail: Ottawawantsthepowertocreatesecretbackdoorsinournetworkstoallowforsurveillance● iPhoneinCanada: FedsWantSecretBackdoorsforNetworkSurveillance: Experts● NationalObserver/CentreforInternationalGovernanceInnovation(op-edbySharonPolsky):TheRoadtoDigital Hell ispavedwithGoodIntentions● TheHub: Trudeaupromisedradical transparency.

Instead, hehasexacerbatedclosedgovernment(op-edbyMattMalone)● MichaelGeistPodcast: InterviewwithCitizenLab’sKateRobertsononBill C-26● GlobalNews: ContentiousLiberal plantooverhaul cybersecurityfacesmorescrutiny● CanadianPress: Federal cybersecuritybill threatensprivacy, transparency, civil societygroupssay(JimBronskill)● NewsForum-CanadianJustice: Bill C-26, Cybersecurity&Civil Liberties(HostChristineVanGeyninterviewsDrBrendaMcPhail(CCLA)andOpenMedia’sRosaAddario)● CTVNewsPowerPlay: InterviewwithDrChrisParsons● CanadianPress: Liberal cybersecuritybill a'badlaw' thatmustbeamended, researchreportwarns(JimBronskill)● ITWorldCanada: ProposedtelecomcybersecuritylawgivesCanadiangovernmenttoomuchsecretpower: Researcher● PolicyOptions: Don’tgiveCSEmorepowersuntil itsubmitstoeffectivereview(DrChrisParsons)● HillTimes: Canadians’ privacycouldtakeaserioushitthiscominglegislativesession(KenRubin)● TorontoStar(Op-EdbyOpenMedia): MPsmustsaynotoagencyrequestforpowerstospyonyourbankandtravel records 20