SECU meeting 9 · 2025-10-28 — Committee Evidence — LegisWatch

Summary

The House of Commons Standing Committee on Public Safety and National Security met to study Bill C-8, an act respecting cybersecurity and amending the Telecommunications Act. Appearing were Bridget Walshe, Associate Head of the Canadian Centre for Cyber Security; Andre Arbour, Director General of the Telecommunications and Internet Policy Branch at the Department of Industry; Kelly-Anne Gibson, Director of the Cyber Protection Policy Division at the Department of Public Safety and Emergency Preparedness; Daniel Couillard, Director General of Cyber Partnerships at the Canadian Centre for Cyber Security; and Colin MacSween, Director General of the National Cyber Security Directorate at the Department of Public Safety and Emergency Preparedness.

Bridget Walshe described the evolving cyber-threat landscape, including state-sponsored threats and cybercrime-as-a-service platforms, and stressed that cybersecurity requires collaboration across government and industry. She noted that Bill C-8 builds on Bill C-26 to establish a regulatory framework for baseline cybersecurity of critical sectors, with mandatory incident reporting to the cyber centre focused on technical indicators of compromise, and that CSE gains no new authorities under the bill.

Andre Arbour explained that the minister's powers under part 1 of the bill are scoped to protecting the telecommunications system, not individual speech or data, and that orders must be reasonable relative to the threat. He noted that the authority to withdraw services targets entities like those conducting distributed denial of service attacks, not individual Canadians, and that safeguards include consultation requirements, notification to NSIRA and NSICOP, annual reports to Parliament, and judicial review. He disagreed with concerns that the broad wording "to do anything, or refrain from doing anything" could enable encryption-breaking, stating that such actions are out of scope and that the bill explicitly prohibits intercepting private communications.

Kelly-Anne Gibson said that designated operators under part 2 are responsible for managing supply chain and third-party risks through their cybersecurity programs, using guidance from the cyber centre. She noted that the bill does not directly address competitive fairness but that a secure environment protects the economy, and that penalties are set high but within industry-typical ranges. She confirmed that civil liberties organizations were consulted and their submissions considered.

Daniel Couillard added that the cyber centre has strong working relationships with provinces and territories, sharing threat information regularly, and that mandatory reporting under Bill C-8 will improve the centre's ability to identify threats and notify affected entities. He noted that over 1,400 incidents were reported voluntarily in 2024-25.

Colin MacSween clarified that mandatory reporting under part 2 will not require reporting every breach; regulations will define a threshold for significant incidents, informed by discussions with Five Eyes counterparts.

The committee debated and then agreed on a motion for the study of Bill C-12, setting a witness list deadline of November 3, 2025, scheduling four meetings for witness testimony, and beginning clause-by-clause consideration at a fifth meeting without limiting the number of meetings needed to complete it.

AI-generated summary — may contain errors; verify against the official evidence.

Witnesses · 5

Bridget Walshe

Associate Head, Canadian Centre for Cyber Security, Communications Security Establishment

Opening remarks

Thank you, Mr. Chair. Good afternoon, Chair and members of the committee. Thank you for inviting us today to discuss Bill C-8, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. My name is Bridget Walshe. I am the associate head of the Canadian centre for cybersecurity—also known as the cyber centre—within the Communications Security Establishment Canada. I'm joined by my colleague Daniel Couillard, director general of partnerships and risk mitigation. The Canadian centre for cyber security is Canada's technical authority on cybersecurity. We lead the government’s federal response to cybersecurity events and serve as a unified source of expert advice. We're pleased to be here today to discuss Canada's cyber-threat landscape and the importance of cybersecurity in the context of Bill C-8. I want to begin with a simple truth: Our world has never been more connected. From the smart phones in our pockets to the satellites orbiting above us, technology has woven itself into the very fabric of our daily lives. It powers our communications, our economies, our health care systems and even our democracies, but with…

Full testimony ↗

Andre Arbour

Director General, Telecommunications and Internet Policy Branch, Department of Industry

Opening remarks

The powers under Bill C-8 concern the ongoing regulation in terms of the security of underlying infrastructure. In the instance of telecommunications, it's Bell's network infrastructure. They do not engage with certain charter rights or privacy considerations in that context. Similarly, that's how telecommunications operators are currently regulated. For instance, in the allocation of spectrum licences that are necessary to run their wireless networks, that's currently an authority under the Minister of Industry and there's no need for judicial oversight.

Daniel Couillard

Director General, Cyber Partnerships, Canadian Centre for Cyber Security, Communications Security Establishment

Opening remarks

Since the Canadian centre for cyber security was created, we have worked extensively on our relationships with the provinces and territories. As my colleague mentioned, incidents are reported to us, and that's been the case since the centre opened. In 2024‑25, more than 1,400 cybersecurity incidents were reported to the centre. In every case, we worked with other jurisdictions. We shared information. Many cases involved regulated entities with cross-border operations in the U.S., Canada or the provinces. We are familiar with those situations, and we've been examining them for a number of years now. Under Bill C‑8, it will be mandatory to report certain incidents. The idea behind the approach is that the more information we have, the better equipped we are to identify the threat and notify the targeted entity, as well as other entities in the sector. They can then work proactively to protect themselves, while protecting other sectors as well. As we know, Canada's critical infrastructure sectors are highly interconnected, so timely responses are key. We are familiar with all that, and with Bill C‑8, we'll be able to gather and share that wealth of information.

Full testimony ↗

Public Safety and National Security

Summary

Witnesses · 5

Bills mentioned