Canada’s cybersecurity in dire need of an upgrade

A lot has changed since February 2020, and the world in which we now find ourselves is vastly different from the one before. While the COVID-19 pandemic was racing around the world, ever-changing and evolving, so, too, were advancements in cyber technology—especially advancements in artificial intelligence (AI). The processes AI is now capable of performing have jumped lightyears ahead from where they were just two-and-a-half years ago, leaving Canada vulnerable to foreign influence operators, superscale phishing attacks, and AI-generated malware. The growing threats to Canada’s cybersecurity are very real and concerning, and our capacity to deal with them must be strengthened and enhanced. Canada is far behind similarly situated jurisdictions in its ability to intercept and respond to cyber security threats, with the United Kingdom and France, for example, far advanced by comparison. The House of Commons’ Standing Committee on Public Safety and National Security has heard from witnesses who warn that Canada’s cybersecurity infrastructure is in dire need of upgrading. We are vulnerable to threats by nefarious actors, domestic and foreign, leaving critical infrastructure and the private information of Canadians at risk: from the banking sector to health records, municipalities, the education sector, and vital supply chains including water, energy, transportation, manufacturing, and food. The committee also heard that existing Canadian legislation with respect to cybersecurity does not compare well with that of other nations, leaving us too weak to act when attacks do occur. There is an acknowledgement that we must increase capacity for Canadian intelligence and cybersecurity partners to beef-up moderation of social media algorithms used to amplify fear, anger, and hatred within specific demographics, and to counteract deliberate misinformation and disinformation campaigns. Businesses, organizations, and individuals who fall victim to cybersecurity breaches, or ransomware, often fail to report the breach due to the threat of extortion or otherwise embarrassment. The consequence is that our country has incomplete data on the number of cyber threats and attacks that have been carried out. The government’s Bill C-26 is purported to provide a framework for the protection of the Canadian telecommunications system and the critical cyber systems of services and systems that are vital to national security or public safety under federal jurisdiction. It is meant to provide tools to respond to threats, requiring owners and operators to meet various obligations, such as establishing cybersecurity programs and mandatory reporting of cybersecurity incidents, and it is said to serve as a model for provinces, territories, and municipalities for critical infrastructure outside federal jurisdiction. While greater tools to respond to these emerging threats are needed to protect Canadians, I have some serious concerns with the powers proposed in the new legislation, which have been echoed by groups like OpenMedia, the Citizen Lab, and the Canadian Civil Liberties Association. Orders made by the governor-in-council or by the minister can be kept secret from publication in the Canada Gazette. The bill also provides for an exemption from the Statutory Instruments Act, which means that the joint Scrutiny of Regulations Committee can’t review those orders. There are also some pretty hefty fines for non-compliance with these orders, including $25,000 to $50,000 for individuals, and $10- to $15-million for organizations. Powers given to various government ministers, their agents, and regulators are overly broad, and there is little evidence in the bill of parliamentary oversight or review. Advancements to protect cybersecurity and secure critical infrastructure are necessary, but they cannot come at the cost of democratic oversight or transparency and accountability. I will be consulting with a wide range of experts and carefully reviewing each clause of C-26 to ensure this legislation meets these standards. Alistair MacGregor was elected in 2015 as Member of Parliament for the new riding of Cowichan–Malahat–Langford, B.C. He was re-elected in 2019 and 2021. MacGregor currently serves as the NDP critic for agriculture and agri-food, public safety, and the deputy critic for justice. He also serves as a member and vice-chair of the Special Joint Committee on Medical Assistance in Dying. The Hill Times