1 Subject: Urgent Need to Pass Bill C-26 to Enhance Cybersecurity and Improve Public Service Delivery I hope this letter finds you both in good health and spirits. I am writing to you as an American-Canadian Systems Security and Cyber Security Practitioner with prior experience in our public service related to cyber security, concerned about the present state of our national digital security landscape. A cyber attack occurs globally every 39 seconds, underlining the critical urgency to strengthen our defences against such threats, which are growing in complexity and potential harm.

Cybersecurity is not simply a localized issue for technologically developed economies; it is a global one, and Canada must be at the forefront of tackling it. The recent creation of the Department of Cyber Security and Digital Solutions in Nova Scotia1 reflects the growing need for services that are swiftly responsive, effectively tailored, and conveniently delivered. 1 New Department to Focus on Digital Services, Programs. Government of Nova Scotia. https://novascotia.ca/news/release/?id=20230524001. Oct 24, 2024 Ashar S.

Ahmed, BCSc, MSc, SSCP, CC The discourse around Bill C-26 has been marked by disagreeme nts and controversy, largely due to the concerns about potential centralization of power and privacy issues that may arise from its enactment. As a professional deeply involved in the cybersecurity sector, I am firmly convinced that the importance of passing this legislation far surpasses these concerns.

Senator Jean-Guy Degenais Senator Tony Dean Chair, SECD Committee Senate of Canada Ottawa, ON, K1A 0A4 Vice Chair, SECD Committee Senate of Canada Ottawa, ON, K1A 0A4 Dear Senators Dean and Degenais, UNCLASSIFIED//OFFICIAL USE ONLY 2 This department is a pioneering step in transforming how services are delivered and improving cybersecurity in the province, a feat that Bill C-26 can emulate on a federal scale. However, it is essential for all parties to engage in collaborative dialogue, find common ground, and address the concerns while maintaining the spirit of the legislation.

To address these concerns while preserving the spirit and objectives of Bill C-26, I’ve proposed a set of amendments centred around the following principles: Power Authorized: This aspect empowers the Minister or a designated officer, in consultation with the CSE, to direct a telecommunications service provider to take specified actions to secure the Canadian telecommunications system. This gives the government the necessary authority while maintaining safeguards against undue interference.

Data Protection Standards: The proposed amendment emphasizes adherence to existing Canadian data protection laws, such as PIPEDA, which should alleviate concerns about privacy and misuse of data. Transparency and Accountability: Provisions requiring written explanations for orders, stakeholder consultations, and public disclosures strengthen accountability and should dispel concerns about unchecked power. Appeal Process: The proposed amendment provides an appeal process to the NSIRA, which would serve as a vital check on government authority and ensure that orders are justifiable and proportionate.

In closing, I implore you and all members of the SECU Committee to focus on the critical importance of Bill C-26 for our nation's cybersecurity and public service delivery. The risks of delaying or diluting this legislation are far too great. Please consider my suggestions, and work diligently towards a consensus that will lead to enhanced digital security and improved service delivery for all Canadians. Thank you for your time and consideration. I am confident that under your leadership, our nation will navigate toward a secure and efficient digital future.

Respectfully, Systems Security / Cyber Security Practitioner ����������������������������������� OrderStartofinsertedblock(2) TheMinister, oradesignatedofficerauthorizedbytheMinister, may, inconsultationwiththeCommunicationsSecurityEstablishment(CSE),byorder, directatelecommunicationsserviceprovidertodoanythingorrefrainfromdoinganything—otherthanathingspecifiedinsubsection(1)or15. 1(1)—thatisspecifiedintheorderandthatis,intheMinister’sordesignatedofficial'sopinion,necessarytosecuretheCanadiantelecommunicationssystem,includingagainstthethreatofinterference,manipulation,ordisruption.Intheorder, theMinisterordesignatedofficialmay, amongotherthings, (

a) prohibitatelecommunicationsserviceproviderfromusinganyspecifiedproductorservicein,orinrelationto, itstelecommunicationsnetworkortelecommunicationsfacilities,oranypartofthosenetworksorfacilities; ... (

l) requirethatatelecommunicationsserviceproviderimplementspecifiedstandardsinrelationtoitstelecommunicationsservices,telecommunicationsnetworksortelecommunicationsfacilities. DataProtectionStandards(5)IncollaborationwiththeCommunicationsSecurityEstablishment(CSE),theMinisterordesignatedofficialshallensurethatthemanagementofinformationobtainedfromtelecommunicationsserviceprovidersadherestodataprotectionstandardsincompliancewithexistingCanadiandataprotectionlaws,includingthePersonalInformationProtectionandElectronicDocumentsAct(PIPEDA).

TransparencyandAccountability(4)TheMinisterordesignatedofficialshallensuretransparencyandaccountabilityinthedecision-makingprocessby: (a)providingawrittenexplanationoftherationalefortheorder, includinganassessmentofthepotentialrisks,benefits,andimpactontheaffectedtelecommunicationsserviceprovider; (b)regularlyreviewingandupdatingtheordertoensureitscontinuednecessityandproportionalityinrelationtotheintendedpurpose; 1 (c)consultingwithrelevantstakeholders,includingtheaffectedtelecommunicationsserviceprovider, priortoissuingoramendingtheorder, unlessdoingsowouldunderminethepurposeoftheorder; (d)publiclydiscloseasummaryoftheorder, subjecttothelimitationsnecessarytoprotectsensitiveinformationandnationalsecurityconcerns.

AppealProcess(3)Atelecommunicationsserviceprovidermayappealanorderissuedundersubsection(2)totheNationalSecurityandIntelligenceReviewAgency(NSIRA)asanindependentreviewboard.TheNSIRAshallhavetheauthoritytoreviewtheorder, hearfromboththeMinisterordesignatedofficialandtheaffectedtelecommunicationsserviceprovider, anddetermineiftheorderisjustifiedbasedontheevidencepresentedwhiletakingintoconsiderationtransparencyandaccountabilityrequirements.TheNSIRAshallissueadecisionwithinaspecifiedtimeframe,anditsdecisionshallbebinding.Endofinsertedblock 2