Today, Minister Gary Anandasangaree and Minister Melanie Joly highlighted that Bill C-8: An Act Respecting Cyber Security (ARCS) received Royal Assent.
This legislation helps strengthen the security of the country’s telecommunications system, and bolsters cyber security across the financial, telecommunications, energy, and transportation sectors.
ARCS amends the Telecommunications Act to add security as an explicit policy objective and provides the government with new authorities to compel action against threats to the telecommunications system. ARCS also introduces the Critical Cyber Systems Protection Act, which creates a regulatory framework requiring designated operators in the finance, telecommunications, energy, and transportation sectors to protect their critical cyber systems.
Ultimately, ARCS will help safeguard Canadians’ safety, privacy and economic stability by ensuring that essential services remain secure and operational in the face of evolving digital risks.
Canada’s critical infrastructure is becoming increasingly interconnected, interdependent, and integrated with cyber systems, particularly in the context of 5G, artificial intelligence, and future networks.
Maintaining and enhancing Canada’s cyber security requires a nation-wide effort. This includes all levels of government, private sector, academia and our international partners.
That is why the Government of Canada is taking important steps to further protect Canada’s critical infrastructure systems through An Act Respecting Cyber Security (ARCS), which has now received Royal Assent. Part 1, which makes amendments to the Telecommunications Act, came into force upon Royal Assent, while Part 2, which enacts the Critical Cyber System Protections Act (CCSPA), will take effect gradually.
This legislation amends the Telecommunications Act to add security as a policy objective and provide the government with new security-related authorities. It also introduces the CCSPA to create a regulatory framework requiring designated operators in the finance, telecommunications, energy, and transportation sectors to protect their critical cyber systems.
ARCS is part of the government’s commitment to improving the standard for cyber security across Canada, and helps ensure the security and public safety of Canadians by:
Adding “security” as a policy objective for the Telecommunications Act;
Creating order-making authorities for the Governor in Council and Minister of Industry under the Telecommunications Act;
Creating regulations specific to cyber security for federally managed sectors;
Providing the legislative authority to direct action in response to cyber threats; and,
Supporting increased cyber threat information sharing.
In particular, changes to the Telecommunications Act provide the government with a clear and explicit legal authority to require that telecommunications operators take, or refrain from taking, certain actions when necessary, to secure their systems. This includes the authority to prohibit Canadian telecommunications service providers from using products and services from certain high-risk suppliers.
The CCSPA will form the foundation for securing Canada’s critical infrastructure against evolving cyber threats.
The legislation will improve and support organizations’ abilities to prepare, prevent, respond to, and recover from all types of cyber incidents, including ransomware.
More secure and resilient critical infrastructure will ensure the safety and well-being of Canadians while spurring growth and innovation, which are key drivers for a healthy economy.
Amendments to the Telecommunications Act:
The government takes the security of Canada’s telecommunications system very seriously and will continue to promote the security of Canadian networks, while championing technologies such as 5G wireless technology and future networks.
The government’s statement on May 19, 2022 regarding telecommunications security indicated its intention to prohibit the use of high-risk products and services in Canada’s telecommunications systems. The authorities proposed under ARCS will allow the Government to implement and action its intention to ban high-risk suppliers, and to address increasing threats to telecoms networks, including those related to supply chains, cyber security, and hazards like natural disasters.
These legislative amendments align with actions taken by Canada’s Five Eyes partners and will allow Canada to take strong action against threats to the security of our telecommunications sector.
Now that these legislative measures have come into force, Canada has an even more robust set of tools at its disposal to support and protect the security of Canada’s telecommunications system.
Canada fully recognizes the complex nature of the threat posed by a range of malicious actors who seek to use 5G systems to undermine Canadian and allied safety, security, defence, and economic interests.
Bill C-8 includes safeguards to ensure the authorities it creates are used appropriately, with oversight mechanisms designed to prevent misuse and protect Canadians’ digital rights.
For example, the Minister of Industry may issue orders to Telecommunications Service Providers only when it is deemed necessary in order to secure the Canadian telecommunications system against a particular threat, and reasonable in relation to the gravity of the threat being addressed. The Minister must also give consideration to the order’s financial and operational impact on Telecommunications Service Providers, as well as its potential effect on the provision of telecommunications services to Canadians, including the confidentiality and security of telecommunications.
Critical Cyber Systems Protection Act (CCSPA):
Cyber threats are evolving rapidly, increasing in frequency and becoming more sophisticated with more damaging consequences for Canada’s economy, national security and public safety.
The CCSPA will be the foundation for securing Canada’s critical infrastructure against evolving cyber threats, including ransomware.
Currently, the legislative framework will only apply to federally regulated services and systems in the finance, energy, telecommunications, and transportation sectors. The government may seek to apply the CCSPA to other federally regulated sectors in the future.
The legislation requires designated owners and operators of these vital systems and services to meet obligations aimed at raising their baseline level of cyber security.
It will also require incident reporting to the government, which will create a more thorough understanding of the threats and vulnerabilities that exist in the Canadian cyber ecosystem.
Finally, the CCSPA provides a clear and explicit legal mechanism to compel organizations to take action to address a cyber security threat or a vulnerability.
While the CCSP only covers federally regulated service, the Federal Government will work to support other jurisdictions implementing their own frameworks to protect critical infrastructure.
The Federal Government will begin consultations on regulations with industry stakeholders shortly.
