SECU Committee Meeting

     I call this meeting to order.

    Welcome to meeting number 91 of the House of Commons Standing Committee on Public Safety and National Security.

    Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Members are attending in person in the room and remotely by using the Zoom application.

    I would like to make a few comments for the benefit of the witnesses and members.

    Please wait until I recognize you by name before speaking.

    To prevent disruptive audio feedback incidents during our meeting, we kindly ask that all participants keep their earpieces away from the microphone. Audio feedback incidents can seriously injure interpreters and disrupt our proceedings.

    This is a reminder that all comments should be addressed through the chair.

    Pursuant to the order of reference of Monday, March 27, 2023, the committee is resuming its study of Bill C-26, an act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other acts.

    Today we have two panels of witnesses. I would like to welcome our witnesses for the first panel.

    From the Business Council of Canada, we have vice-president of policy and legal counsel Trevor Neiman. From the Canadian Internet Registration Authority, we have Byron Holland, president and CEO.

    Up to five minutes will be given for opening remarks, after which we will proceed with rounds of questions.

    Welcome to all.

    Now I invite Mr. Neiman to make an opening statement, please.

     Mr. Chair and committee members, thank you for the opportunity to take part in your study of Bill C-26.

    Founded in 1976, the Business Council of Canada is composed of approximately 170 chief executive officers who run Canada's most innovative and successful businesses. Our organization represents a broad cross-section of Canada's critical infrastructure sectors.

    Today I will restrict my comments to part 2 of the bill, which is the proposed critical cyber systems protection act.

    I'll begin my substantive remarks by underlining that Canada's leading businesses are committed to maintaining a strong and resilient security posture in the face of growing cyber-attacks. Indeed, in a survey of our members, every single chief executive officer indicated that cybersecurity was either a high or very high priority for their business.

    Our members are backing their commitment to cybersecurity with significant resources. In critical infrastructure sectors, most of our member companies each invest well over $100 million in Canada per year on measures to prevent, detect and respond to cybersecurity incidents. A plurality of these same members invest over $500 million individually in the same measures.

    As cybersecurity risks to the country grow, so too do the resources that our members plan to devote to protecting Canadians. Over the next two years, over two-thirds of our members plan to increase both their cybersecurity spending and their personnel staffing by at least 25%.

    However, we cannot lose sight of the fact that defending Canadians against cyber-attacks is very much a team sport, requiring close coordination between government and industry.

    That is why the Business Council of Canada supports the objectives of recent government cybersecurity initiatives. This includes part 2, which, if properly drafted and implemented, can improve the overall cyber-resiliency of the Canadian economy by establishing a baseline of cybersecurity across critical sectors.

    It's also important to note that the enactment of part 2 would bring Canada's cybersecurity framework in line with the best practices among our closest security partners. In a period of growing global tensions, Canada must move in lockstep with its closest allies and strengthen its cyber-resiliency; otherwise, Canada risks being perceived as a weak link, which could have severe consequences for Canadians' future security and prosperity.

    Of course, no public or private sector initiative is perfect. It should therefore be no surprise that Canada's business leaders would like to see targeted amendments to part 2. In the interest of time, I will highlight just three of the most common suggestions for improvements that I've heard from our members.

    First, part 2 should be amended to adopt a risk-based methodology that would impose regulatory requirements on designated operators proportionate to their level of risk. Imposing fewer and less onerous obligations on low-risk operators that have well-established cybersecurity programs would allow them to spend more of their finite resources on incident prevention activities. Regulators, on the other hand, could dedicate more of their finite resources toward the high-risk operators that pose the largest threat to Canadians.

    Second, part 2 should be amended to place fair and reasonable limitations on the cabinet's power to issue cybersecurity directions. In the absence of statutory safeguards, part 2 would allow cabinet to issue any direction, regardless of whether such a measure would be effective in reducing a risk to a critical system. Directions could also be issued without cabinet first consulting with impacted provinces and territories, negotiating in good faith with designated operators or considering relevant factors, such as the potential cost of a direction, whether reasonable alternatives exist to issuing a direction and the potential consequences of a direction on competition, services or customers.

    Third and last, part 2 should be amended to define key terms more precisely, such as “cyber security incident” and “critical cyber system”. The current definitions of these terms are overly broad. This would likely result in reporting inconsistencies, as well as the over-reporting of immaterial incidents, which could overwhelm government authorities.

    I'll conclude by noting that part 2 is just one of several national security reforms that are urgently needed to protect Canadians. As a priority, the Business Council of Canada urges that lawmakers also amend the CSIS Act to enable CSIS to proactively share threat intelligence with Canadian companies when it's in the public interest, subject to all necessary safeguards and oversight.

    This and nearly 40 other much-needed reforms are included in the Business Council of Canada's most recent report, “Economic Security is National Security”. That report is publicly available on our website.

    Thank you for the opportunity to speak. I look forward to your questions.

     Thank you.

    Mr. Holland, go ahead, please.

    Mr. Chair and members of the committee, my name is Byron Holland. I am the president and chief executive officer of the Canadian Internet Registration Authority, or CIRA. Thank you for the invitation to share our views and recommendations on Bill C-26.

    CIRA is a private, not-for-profit organization best known for operating the “.ca” registry, with 3.4 million .ca domain names under management. CIRA's core mandate is a safe, stable and secure operation of the .ca domain and the global network that ensures that it's available no matter where in the world you are. We also have a broader mission to promote a trusted Internet, which we work toward by providing high-quality registry, domain name system and cybersecurity services, and by investing in the Internet community in Canada.

    CIRA participates in numerous fora to promote the security and resilience of the Internet. Recently, this has included ISED's Canadian forum for digital infrastructure resilience and the CRTC interconnection steering committee. We are also long-time participants in global Internet governance. This includes extensive engagement with the Internet Corporation for Assigned Names and Numbers, or ICANN, the global overseer and coordinator of the domain name system that ensures that your web browser can reach websites like Canada.ca. We also contribute to the Internet Engineering Task Force, or IETF, where the technical standards that underpin the Internet are developed.

    CIRA also provides cybersecurity services to help Canadians stay safe online. They include Canadian Shield, our free cybersecurity service that protects an estimated four million Canadians from online threats; DNS Firewall, our enterprise-level DNS protection used by more than a thousand Canadian organizations, including numerous critical cyber systems; and Anycast DNS, our global infrastructure that increases the performance and resilience of top-level domains like .ca, and helps mitigate malicious activity such as distributed denial of service attacks from foreign actors. Moreover, CIRA collaborates with several institutions to keep these services up to date, including the Canadian Centre for Cyber Security and the Canadian Centre for Child Protection.

    CIRA strongly supports the government's objective to raise the baseline level of cybersecurity across critical infrastructure through Bill C-26.

    We offer three recommendations to part 2 of Bill C-26, also known as the critical cyber systems protection act, or CCSPA, to better balance the bill's cybersecurity objectives with well-established best practices and oversight, information sharing and transparency.

    First, to promote more effective oversight, the issuance of cybersecurity directions under the CCSPA should be subject to section 3 of the Statutory Instruments Act. This would ensure that cybersecurity directions are examined by the Clerk of the Privy Council in consultation with the deputy minister of justice.

    Second, to increase confidence in the proposed information sharing enabled by the CCSPA, conditions on the use of information should be strengthened. Currently, Bill C-26 does not explicitly limit how government entities can use information collected under certain sections. For example, CIRA believes it would not be appropriate for the CSE to use data collected under section 15 of the CCSPA for purposes other than its cybersecurity and information assurance mandate.

    Third, to promote transparency, the CCSPA should be amended so that information on cybersecurity directions is reported to Parliament on an annual basis. This would include information on the number of cybersecurity directions issued and revoked, as well as the number of designated operators impacted.

    We have provided specific legislative wording for each of our recommendations in our written submission.

    In conclusion, CIRA recognizes the need for some level of secrecy and timeliness in matters of national security and public safety. However, secrecy and expedience must be counterbalanced by the addition of provisions in Bill C-26 that would enhance Canadians' trust and confidence in the proposed legislation.

    Thank you.

    Thank you, Mr. Holland.

    I'll now open the floor to questions.

    Mr. Motz, you're up first for six minutes.

     Thank you very much, Chair.

    Thank you to the witnesses for being here.

    While I and my colleagues certainly agree that Bill C-26 is an important piece of legislation that has been a long time coming, and that we need to protect our critical infrastructure, I'm going to take this opportunity to move the following motion, which has been properly placed before the committee:

    Now, it's critically important that we understand why we are bringing this motion forward. It is very important to remember that the Federal Court rendered a decision last week that was critically important, and it should have been a landmark for this country and for this government.

    In order for us to have a clear understanding of what the Emergencies Act was about—how it came to be—and of the decision of this Federal Court and all those sorts of different nuances, I want to take some time just to provide a very paraphrased version, a summary, of the Federal Court—just a couple of pages.

    In Ottawa on January 23, the Honourable Justice Richard Mosley of the Federal Court issued his decision. In part, it read as follows:

    The decision went on to say:

    Those of you who are lawyers will understand “ultra vires”.

    The court said that they acted “beyond one's legal power and authority”. That's what the Latin term “ultra vires” means. It literally means that it's beyond the scope, or in excess of, power and authority.

    Judge Mosley's decision continued:

    The second question as put forward by Justice Mosley was as follows:

    What do those sections actually say in the charter? Section 2 says:

    Section 7 talks about “Life, liberty and security of person”:

    Section 8 of the charter deals with “Search or seizure”:

    Justice Mosley asks if they could “be saved under section 1 of the Charter”. Section 1 says:

    Justice Mosley continues:

    

    Now, I think it's important to understand how things transpired, why we had a protest and how we got to this point in the first place. It has to do with the increasing degrees of overreach and abuse of power by the Liberal government and its trampling of the charter rights of Canadians.

     In January 2022, nearly two years after the start of the COVID pandemic, Canadians were growing frustrated with government restrictions and mandates. The straw that broke the camel's back was the order that truckers—cross-border truckers, especially—and other essential workers would no longer be exempted from vaccine requirements. This was a threat to their livelihoods and a violation of their rights. For them, enough was enough.

    They gathered from across Canada and came to Ottawa and other locations not just to voice their frustrations but also to be heard by this government. I think it's important to understand that this government had no interest in listening to them, and I know that first-hand.

     I personally worked vigorously behind the scenes to arrange meetings between the then-minister of transportation, Omar Alghabra; the then-minister of public safety, Marco Mendicino; and protest organizer Tamara Lich, with the understanding that such a conversation would result in the protest being dismantled. However, they refused all attempts to make that happen personally with them, even on a phone call. The government completely refused.

     I think, quite honestly, that their unwillingness to dialogue from the very beginning.... Had they changed their attitude, the situation would certainly have been totally different, and it could have been avoided.

    The Prime Minister also added to this. He seemed to be fine stoking division, calling people names and allowing frustrations and tensions to grow to the point that he and his cabinet decided to take their overreach and disregard for charter rights to the next level by stepping outside of the law and their lawful authority by invoking the Emergencies Act for the first time in history.

    What exactly what did that order say? I think it's important that Canadians are reminded of what the Emergencies Act actually said.

     I will quote from the February 14, 2022, Government of Canada bulletin, which reads:

    I think it's also important for Canadians to appreciate that the Emergencies Act laid out requirements for the government to do certain things during and after the invocation. Subsection 62(1) of the Emergencies Act says that there needs to be a review by a parliamentary review committee. It says, “The exercise of powers and the performance of duties and functions pursuant to a declaration of emergency shall be reviewed by a committee of both Houses of Parliament designated or established for that purpose.” I'll get back to that in just a minute.

    The other thing that was required was an inquiry. Subsection 63(1) says, “The Governor in Council shall, within sixty days after the expiration or revocation of a declaration of emergency, cause an inquiry to be held into the circumstances that led to the declaration being issued and the measures taken for dealing with the emergency.”

    I think it's important also to appreciate that Justice Rouleau's decision did not provide Canadians with the confidence they were seeking on both sides of this discussion. He made a decision that the very high threshold required was met; however, he did so reluctantly, very reluctantly, and he says so in his decision. He accepted the government's broader interpretation of the Emergencies Act without being given an opportunity to see it. He was troubled by that particular move. He also included in his report that he did not come to this decision easily, and interestingly, he states that the facts that he based his decision on were not overwhelming.

     To me, the statement that says it all about how Canadians should lack confidence in his decision is that a reasonable and informed person could reach a different conclusion than he arrived at. That does not actually give Canadians much confidence.

    Now, getting back to the parliamentary review committee, it was called the special....

    Mr. Chair, with regard to the commentary over there, if the member wishes to participate in this debate, I invite him to do so after I'm done.

    Thank you.

    I have a point of order, Mr. Chair.

    This is just another example of the Conservatives pretending to care about security. We have witnesses here to talk about cybersecurity, which the Conservatives pretend to care about but clearly don't.

    You can grandstand all you want somewhere else.

    “Grandstand all you want”? Really?

    This is from the person who's grandstanding—

    Everyone, can we just stop for a moment, please?

    Listen—

    The person who is grandstanding is working with Tamara Lich. Wow. This is unbelievable—

    Mr. Bittle, Mr. Bittle—

    This is unbelievable. You are making witnesses....

    Who's the grandstander?

    Mr. Chair....

    It's clearly you.

    Please, everyone, I'm going to say this once.

    We had an incident in here before that was very close to damaging someone's ears due to the mistake of a microphone just being too close. I asked at the beginning of this meeting that we do not harm the interpreters, so let's not talk over one another. Everybody will have a chance.

    Thank you.

     Thank you, Chair.

     I will continue.

    As I as saying, the Emergencies Act has requirements in subsection 62(1) for a parliamentary committee. A Special Joint Committee on the Declaration of Emergency is required to review “the exercise and powers and the performance of duties and functions pursuant to [the] declaration” by the government.

    Mr. Brock and I are fortunate and on that committee and honoured to be there, along with colleagues from all parties, along with four members of the Senate. It's interesting that we've been meeting since March of 2022, and on December 1 of 2022, the committee moved that an interim report be presented to the House. I think it's very important that this committee—which quite possibly will also be having a look at this particular decision by Federal Court to examine this overreach by government—to hear what the committee, which we affectionately call the “DEDC”, the declaration of emergencies committee, has to say.

    The committee directed “[t]hat the joint chairs be directed to present the following interim report to each House forthwith”:

    On a point of order, Mr. Chair, while I'm enjoying Mr. Motz's presentation, it occurs to me that because part of this motion is a demand for an order for cabinet confidences and privileged communication—lawyer-client privilege—I question whether we have the authority to do this.

     I would ask that we get a ruling as to whether this motion is in order, because it exceeds the powers of this committee.

    Can I speak to that?

    The interim committee report I am presenting to the committee right now gets into the law, the rules and procedures of the House, and the authorities at the House for committees to have the inherent right to have access to and ask for these documents. Therefore, the motion is in order because it complies with the requests from other committees and it is also in compliance with the rules and procedures of the House.

    Thank you.

    Mr. McKinnon, we'll take that into consideration and allow the member to continue.

     Thank you, Chair.

    Under the CSIS Act, “threats to the security of Canada” means:

    I have a point of order, Mr. Chair.

    You have the floor, Ms. Michaud.

    Thank you.

    I don't know if Mr. Motz could tell us how much longer he will be. I understand that the purpose of introducing his motion today is to delay the study of Bill C‑26 . However, we have guests here who have prepared to testify, who have prepared a brief and who have interesting information to share with us to help us do our work on the study of Bill C‑26. That would be of great benefit to all committee members. We have only a few minutes left to ask them questions. According to the schedule, we will change panels for the next hour of the meeting.

    In short, I don't know if Mr. Motz can tell us how much longer he will be. Personally, I find that this shows a great lack of respect for the witnesses here today.

     Mr. Motz, could you give us an indication of how much longer you're going to be?

    I don't know. It could be a couple more days, to be honest with you, and I apologize to the witnesses.

    The issue that we as a committee and that government should be seized with is remedying the egregious overreach of the act, so quite honestly....

    I again apologize to the witnesses. Bill C-26 is important, but to me, this issue supersedes it. Bill C-26 has been on the books since 2022, so—

    Thank you, Mr. Motz. Can you continue?

    I have a point of order, Mr. Chair.

    I'm trying to hear the response. You asked Mr. Motz to provide a response to Madame Michaud's intervention. I'm sitting right beside my colleague Mr. Motz, and all I can hear is chirping from Mr. Bittle. He is laughing. This is extremely disruptive to the functioning of the committee, sir.

    Everyone, let's....

    Mr. Motz, could you please continue? Thank you.

    Thank you, Mr. Chair.

    I would recommend that the witnesses today be excused, because I have no intention of ending until I'm finished.

    Please continue, Mr. Motz.

    Thank you.

    Again, I apologize to the witnesses.

    You have 10 minutes.

    Pardon me?

    They can be dismissed in 10 minutes. They're on for the first hour.

     They're the first set of witnesses, yes. Thank you.

    I'll continue with the interim report on paragraph 14: “François Daigle, Deputy Minister of Justice and Deputy Attorney General of Canada, replied to this order, on June 29....”

    I'm sorry. I read that already.

    Paragraph 16 says:

    —some months later—

    He stated:

     Sorry, Mr. Motz, for the interruption. I was just asking a clarification question to the witnesses on when they leave, on whether they leave at 9:15 or they continue on, because there may be a possibility when you're finished that we can give questions to them. I'm sorry for the interruption. That was my mistake.

    Please continue.

    That's fine. Thank you, Chair.

    As I was saying with regard to paragraph 21, the committee was seized with this now novel interpretation of a broader definition, and that became a theme of the evidence given by ministers and senior officials. What's interesting is that when the ministers and some senior government officials provided their testimony before the Special Joint Committee on the Declaration of Emergency in early 2022, there was no mention from any of them when questioned about that very high threshold that is required in section 2 of the act. There was no mention by any of them of this broader interpretation or broader definition. In fact, it was only when Lametti, Freeland, Mendicino, Trudeau and other government officials testified at the Rouleau commission—

    I have a point of order.

    I'd ask the member to recognize these individuals by their proper titles, per Standing Order 18.

    Mr. Motz, can you please do that?

    Sure.

     Minister Lametti, Minister Freeland, Minister Mendicino, Prime Minister Trudeau and other officials testified at the Rouleau commission in the fall of 2022. That was the first time we heard that everybody was relying on this broader interpretation, this interesting term.

    I and many other Canadians are left to wonder why it took so long from when they started providing testimony to the Special Joint Committee on the Declaration of Emergency in April of 2022. Did it take them that long before...? We never heard about it before then.

    I have some opinions, Chair, on why there was a delay when they were trying to convince Canadians. They acted unreasonably and illegally to invoke the act by relying on some broader interpretation.

    One, I don't believe for a moment that any broader interpretation existed when the Emergencies Act was invoked, as they suggest. If it did exist, it would have been trotted out by the ministers and the government officials at the earliest opportunity.

    Two, this broader interpretation has remained secret. It's been shrouded behind cabinet confidences and shrouded behind solicitor-client privilege, and they have refused to disclose it to our committee, to the Special Joint Committee on the Declaration of Emergency, refused to disclose it to Commissioner Rouleau, and refused to disclose it to Justice Mosley in his decision.

    We all know this government has a history of operating outside the law. When they are not content to operate within the confines of the law, they attempt to break it. Does anyone remember SNC-Lavalin? When they try to justify their unreasonable and illegal overreach, they say they had a broader interpretation. What that really means is this government and this Prime Minister believe they are above the law and are not confined by it.

    That is dangerous, folks; that is very dangerous. Thankfully, the Federal Court has ruled otherwise in a very important landmark decision.

    I'm going to go back to the interim report, Chair, if I may, which says in paragraph 22:

    —counsel for the Canadian Civil Liberties Association—

    I have a point of order, Mr. Chair.

    I'm listening to Mr. Motz, and it seems to me that the motion he's introducing today could be presented to another committee, such as the Special Joint Committee on the Declaration of Emergency, which has already studied the invocation of the Emergencies Act. Do you know that Mr. Motz himself is vice-chair of that committee? He could very well introduce this motion to that committee. That way, the Standing Committee on Public Safety and National Security could focus on studying Bill C‑26. I suggest he do that. It would be much more efficient if this motion were studied by the Special Joint Committee on the Declaration of Emergency.

     Mr. Motz, do you have a response?

    I respect my colleague and I will tell her that the Special Joint Committee on the Declaration of Emergency will be meeting and I'm sure will be discussing this further. This committee also has a responsibility to—

    On a point of order, what Mr. Motz has just said is very important. Is the committee meeting next week?

    Mr. Glen Motz: No.

    Mr. Peter Julian: That's my understanding.

    If that's the case, then it would seem to me a bit premature to have consideration of this motion, as well intended as it might be, if we already have the Emergencies Act committee meeting next week to discuss what was an important ruling. It would seem to me that we, as a committee, could then be seized with the motion afterwards.

    We do have witnesses. It costs thousands of dollars to bring them here, and it would be wise, I think, as Madame Michaud has said, for us to hear from the witnesses so that we can improve the legislation that is so important on cybersecurity. It is costing taxpayers thousands of dollars to bring the witnesses here.

    Following the meeting of the Emergencies Act committee next week would be a good time, I think, to have the discussion around the motion.

    Thank you, Mr. Julian.

    Mr. Motz, do you have any response whatsoever?

    I have lots of responses to that, Chair.

    I'll keep it to this. Several committees can also be seized with dealing with the same issue.

    The joint chairs are meeting next week. There is no full meeting of the special joint committee next week. It's important to realize that while the focus of the special joint committee is different from this committee's focus, this committee deals with national security and emergency preparedness. I don't see a more fitting committee than this one.

    Thank you, sir.

    I have a point of order.

    Some time having passed, I would like to renew my objection to this motion on the basis that I don't believe the committee has the power to deal with it.

    Mr. Motz mentioned the SNC-Lavalin inquiry. I was a member of the justice committee at that time. In order for us to deal with matters pertaining to that inquiry, which involved cabinet confidences and solicitor-client privilege, cabinet had to explicitly grant access to those. We as a committee had no power to gain that access.

    I would renew my concern that this motion exceeds the authority of this committee.

    The House itself cannot override cabinet confidence. It requires an act of Parliament to do that, or the cabinet itself.

    Mr. Glen Motz: I'm getting to that.

    Mr. Ron McKinnon: I would renew my objection.

    I know it's an important question, and I think it's important that the committee be seized with the act itself to deal with it, but I also note that this is a pattern of behaviour from our esteemed colleagues, because in the last meeting we were also disrupted by a motion on car thefts. I'm sure next time it will be about snow removal in Ottawa.

    Anyway, I will renew my objection that this motion is out of order.

    Thank you, Mr. McKinnon.

     I'm going to suspend for a couple of minutes to review this situation with the clerk.

    Thank you.

     We will continue with the meeting, but before we go any further, Mr. Holland and Mr. Neiman have other engagements, so I'm going to ask....

    First of all, thank you for coming. Your testimony will be extremely important for Bill C-26.

    I will ask you a question in case we don't have an opportunity to have you back, if that's appropriate, Mr. Clerk, and I hope it is. If we could ask for a brief of your notes that you were going to discuss with us today, we would certainly appreciate that so that we could put those into the report.

    Mr. Chair, would it also be prudent to perhaps ask for permission to send written questions, if we have any, to the witnesses and have the answers to those questions included in any briefs that they provide? I think that we all have some very important questions for which we'd like to have answers on the record.

    Thank you, Mr. Chair.

    Thank you, Mr. Schiefke. Yes, that's a good point.

    Carry on with the rest of your day. I hope it's as enjoyable as the first hour that you spent with us.

    Now we'll go on to the ruling on cabinet confidentiality. We're still getting some information back on that, so we may have to decide on that a little later.

    Mr. Motz, I'm going to let you continue, but at some point, if we do get the information back, then we may have to do a ruling.

    Thank you very much, Mr. Chair.

    I would like to actually respond with some rulings that exist with regard to whether committees can have access to documents.

    Mr. Motz, can you continue with your motion?

    At some point, if I do that, then I'd be more than happy to listen to those submissions.

    Okay. We have to discuss it. There is precedent already.

    Thank you.

     As a matter of fact, Chair, in the interim report that I'm going through right now from the Special Joint Committee on the Declaration of Emergency, they actually produce.... You will see here in a bit about the jurisprudence that already exists for access to cabinet confidences and documents. I'll get to that in just a couple of minutes.

    I'll pick up on paragraph 25 of the interim report from the Special Joint Committee on the Declaration of Emergency.

    It reads:

    In the report here, Chair, I'm noticing a theme developing between the testimony of ministers.

    This is a sidebar, Chair. Back in my day, if I was to listen to testimony in a court of law and I heard a number of people providing testimony, and they all sounded very much alike, I would certainly have the impression that they got their heads together in cahoots to compare their testimony pretrial.

     Anyway, I'll continue:

    Those are powerful words from the counsel, Mr. Chair.

    Paragraph 35 of our interim report states:

    Again as a sidebar, Mr. Chair, unfortunately Justice Rouleau accepted the novel interpretation by the government without actually seeing it, which I think is a black mark on his work on the committee inquiry.

    I want to go back and remind my colleagues around the table that this interim report was presented by the Special Joint Committee on the Declaration of Emergency of all parties. That is the opinion so far for the last half hour of this report that was submitted. It's not just me talking here.

    —and that's critical—

    —meaning the Ottawa Police Service—

    They're referring back to ministers and cabinet.

    As we can see, Mr. Chair, it certainly has been vulnerable to challenge.

    I think it's important that we read that again. This is Mr. Beatty, who actually crafted the legislation back in the mid-1980s:

    —which has since been done—

    Here it gets to the crux of the transparency, Mr. Chair.

    This is a committee of Parliament talking, with a report being sent to Parliament.

    —and this may be of importance to Mr. McKinnon—

    —meaning the Special Joint Committee on the Declaration of Emergency—

    —not just the special joint committee's power, but all committees' powers—

     This can also be seen in Speaker Milliken's rulings in the Debates from March 2011 and in Speaker Rota's ruling on June 16, 2021, Debates, pages 8548 to 8550).

     50. Similarly, as noted in Erskine May, 25th edition, at paragraph 38.32, the same power to send for records is not considered subject to statutory exception in the United Kingdom House of Commons:

    Paragraph 51 of the interim report goes on to say:

    You can see by that information, Mr. Chair, that there's certainly some precedent to allow for documents to be presented to committees, even if they are behind cabinet confidences.

    Now, as I move forward, I think it's important to get a sense of what the response has been. As we move on, I'm going to get into the actual poignant points of the decision from Justice Mosley, but I want to go through some of the comments in the media in response. I'm just going to pick out a few of the comment points that have come through.

    Paul Wells writes, on the 23rd of January, the day of the actual decision by the Federal Court:

    He goes on to say:

    I have a point of order, Mr. Chair.

    Put a finger where you're reading from to get back to it.

    Mr. Glen Motz: Pardon me?

    Ms. Jennifer O'Connell: Put a finger where you're reading from to get back to it.

    Mr. Glen Motz: Thank you.

    Ms. Jennifer O'Connell: Mr. Chair, I think it's important to point out that while Mr. Motz reads from newspaper articles, we have witnesses waiting to appear on the issue of cybersecurity who have taken the time out of their busy day to come and provide their expertise while Mr. Motz proves his reading skills and simply reads newspapers.

    Thank you, Ms. O'Connell.

    Mr. Motz, can you continue, please?

    Thank you very kindly.

    Try to keep it as it applies as much possible to the—

    I have another point of order.

     I would also request that even though Mr. Motz is reading from articles, he should give due recognition of the titles of the people—

    I did. I'm reading what the authors wrote. I'm not going to change what they wrote.

    Well, I think you could interject some respect there.

    Thank you.

    Unfortunately, that's what happens when you interject yourself.... I won't get into that.

    Let's not get into a debate, Mr. Motz.

    Mr. Glen Motz: Thank you, Mr. Chair.

    The Chair: Please make sure that you identify the articles and the authors.

    Go ahead, Mr. Shipley.

    I have a point of order.

    I'm sorry: He was reading a quote. Do you, Chair, expect him to change the quote?

    I have a point of order—

    Hold on, guys.

    Mr. Shipley, I just said to Mr. Motz that he should just read the article and identify the paper that it's coming from and the author. That's it.

     We're good with that. Okay. He doesn't have to change the titles.

    Thank you.

    Thank you.

     I have a a point of order.

    Go ahead, Mr. Julian.

    Thank you, Mr. Chair.

    We have spent thousands of dollars to get these witnesses here. This is an important bill on cybersecurity. I'm wondering if you could ask Mr. Motz to pause the debate and allow the witnesses to provide that testimony. We can come back to the debate at the next meeting. I don't understand why we would take thousands of dollars of taxpayers' money to invite witnesses to testify and then not hear them on an important cybersecurity bill.

    Thank you, Mr. Julian.

    Mr. Motz, you heard the question from Mr. Julian. Could you...?

    Yes.

     I know he's an NDP colleague, but I actually like Peter. If we could adjourn this debate on this motion, and in the time that we have remaining go to Bill C-26, I'm fine with honouring his request.

     He moved a motion to adjourn. Let's call it.

    No, I did not.

    Yes. You just did.

    I said to suspend this conversation.

    You said “adjourn.”

     I did not move a motion. I'm agreeing with him to get to Bill C-26 for the remainder of our meeting today and I'll pick this up at the next meeting.

    Thank you very much.

     Is it the agreement of the committee?

    Some hon. members: Agreed.

    The Chair: Okay. We'll go to our witnesses. We'll suspend for two minutes while our witnesses get in place.

    I call this meeting back to order.

    I would like to welcome our second panel of witnesses.

     By video conference, from the Canadian Constitution Foundation, we have Joanna Baron from Toronto. She is the executive director. In person, from the Centre for International Governance Innovation, we have Aaron Shull, managing director and general counsel, and from the Privacy and Access Council of Canada, we have Sharon Polsky, president. Welcome.

    If whoever wants to start could do an introduction, that would be appreciated.

     Good morning.

    My name is Joanna Baron. I'm executive director of the Canadian Constitution Foundation. I am happy that I didn't cost taxpayers thousands of dollars to appear by video conference this morning.

    Shall I go into my remarks?

    The Chair: Yes, please.

    Ms. Joanna Baron: Thank you very much.

    I'm here, of course, to address Bill C‑26. This is a bill that grants the government sweeping new powers. We have concerns that there is no accompanying regime of checks and balances to safeguard rights. I'd like to speak to some of these points on behalf of a legal charity dedicated to defending fundamental freedoms.

    As drafted, the bill threatens to undermine our privacy rights as well as the principles of accountability and due process, which form the bedrock of our democracy. The powers proposed by the bill risk impacts on the charter-protected rights of privacy, freedom of expression, equality and the right against unreasonable search and seizure.

    Of course we understand that cybersecurity is a huge imperative. We do not believe or accept that cybersecurity ought to come at the cost of civil liberties.

    The proposals that the CCF is pleased to sign on to, along with other civil liberties groups, align with other international approaches such as those taken by our partners in the U.K. and Australia, both of which place a far greater emphasis on proportionality, accountability and privacy rights.

    The issues raised by this bill apply to Canadians in our everyday lives. For example, under the bill, if someone's device or smart appliance were hacked and used to target a government website, the federal government could order their telecom service to be shut off in an order that could be kept secret from the public. The affected person or business would never even know that it was the government that ordered their service disconnected.

    The bill also does not provide a mechanism for restoring service to individuals or businesses who lose it, which obviously interferes with basic livelihood in 2024.

    I'll speak to a few substantive issues.

    The bill raises the spectre of new and pervasive surveillance obligations. It empowers the government to secretly order telecom providers to “to do anything, or refrain from doing anything” . This opens the door to new obligations on private companies as well as to other risks of encryption standards, which pose an inconsistency with privacy rights.

    There are no guardrails in the bill. The bill lacks proportionality, privacy or other checks that might constrain abuse of the new powers it grants the government. These are powers that are backed by steep fines and even potential imprisonment for non-compliance.

    We propose adding a proportionality test and an obligation to consult with experts to help ensure that the minister does not use small problems to justify disproportionate actions. Adding a proportionality requirement will bring Bill C‑26 more in line with our counterparts in Australia and the U.K.

    Next, I'd like to talk about some privacy concerns.

    The bill empowers the government to collect broad categories of information from operators. It may be enabled to obtain identifiable personal data, which can be distributed to domestic and other, perhaps foreign, organizations. The bill does not have a mechanism for limiting what Ottawa can do with the data it collects, nor does it specify periods for data retention or measures to deal with possible negligence with people's data.

    We find that the secrecy provisions undermine accountability and due process. The bill enables the government to shroud its orders in secrecy with no mandatory public reporting requirements. Of course we understand the need for confidentiality, but the public ought to have a sense of how these powers are being exercised, and to what effect, if our elected decision-makers are to be held to account.

    This excessive secrecy has clear implications for the freedom of expression rights of the public as well as the media, as protected by section 2(b) of the charter.

    Finally, I'd like to speak about the use of secret evidence in court, which is authorized by Bill C‑26.

    Even if security orders made under the act are subject to judicial review, the bill could restrict applicants' access to evidence, which is a violation of the rules of natural justice. The minister is permitted to request that some of the government's evidence be heard in camera solely by the judge. The applicant for the review is not permitted to access information that—this is from the statute—“in the judge’s opinion...would be injurious to international relations”—

    Thank you, Ms. Baron. We're scooting over time here, and we're running short overall.

    I apologize.

    No, that's fine.

    We'll go to Ms. Polsky or Mr. Shull or whoever wishes to go next, please.

     Thank you, Mr. Chair.

    Members of the standing committee, ladies and gentlemen, I thought what I could do with my brief time today is offer you a little bit of advice and make you a good faith offer. What I'm going to do is maybe make a general observation.

     I think the bill is pretty good as it stands and a pretty good step forward. Obviously there is a lot of advice in terms of what has been provided to this committee, and most of it's really good. I'm not going to do a clause-by-clause take of the bill, but I'm going to use a quote from former U.S. defense secretary Robert McNamara, which is “Never answer the question that is asked of you. Answer the question that you wished had been asked of you.”

    I wish I was asked the question that the honourable member from Saint-Jeanasked earlier this week, actually, concerning incentives around cybersecurity. The advice I'm going to offer to you is that I think you can make a change to this bill that will do a lot of good. It's to create a tax incentive for small and medium-sized enterprises to implement something called the baseline controls, or the cyber-safe standard. Why this matters is that SMEs are 98% of our economy, and they appear nowhere in this bill.

    Also, the cyber-safe standard that was put in place by the CSE is pretty good. If most SMEs put in place those controls, chances are they'd be just fine, because what I can tell you about cybercriminals is that they're lazy, and that there's another sucker just down the street. If we harden our SMEs through these controls, chances are they'll be just fine.

    If we put in place a tax incentive to encourage cybersecurity compliance rather than a hammer to punish non-compliance, I think that would get us far away toward doing so. Obviously the reason behind this is that it can promote participation. It can strengthen national security and create tons of economic advantages, because fewer companies in our supply chain would be down, so the taxable revenue would likely be up at the end of the year.

    Now, I appreciate that this bill has to get through the House of Commons, and while I'm non-partisan, I appreciate you all have a job to do. I think partisan politics are a healthy part of our democracy, so I encourage the types of discussions that you're all having. However, I am thinking through the politics of it. The Liberal Party would see it aligned with their innovation and economic development agenda. The Conservative Party would see the fiscal responsibility and the national security aspects of what I'm talking about, I think, to be favourable. The New Democratic Party would appreciate the support for our core communities, which are built on SMEs. The Bloc would recognize the protection that this extends to Quebec's economic interests; and the Green Party, I think, would endorse this sustainable approach to securing our digital future.

    That's my advice—put a tax credit in for SMEs to put in place the cyber-safe standard.

    My offer to you is this: I work at one of the best think tanks in the world. If it's of service to this committee, I'm happy to provide draft language of what I think that could look like. Then I'm happy to convene some of our experts to offer further advice or answer any questions that you have. I think you all have a tough job to do.

    The last think I'll say, and then I'll be quiet, Mr. Chair, is probably something you all don't hear enough—thank you for your work. Being a member of Parliament is a tough job. It's demanding, and I don't think most people appreciate how hard you all work.

    Notwithstanding the politics, my job is to provide advice on policy without politics, and I hope I've done so. Thank you, Mr. Chair.

    Thank you, Mr. Shull. I appreciate your comments.

    We have Ms. Polsky. Go ahead, please.

     Thank you very much.

    Thank you for inviting me to appear on behalf of the Privacy and Access Council of Canada, an independent, non-profit, non-partisan organization that is not funded by government or industry.

    Our members, like everybody in this room and the rest of us who use the Internet, can thank Sir Tim Berners-Lee, whose brainchild became the web we know and love—or love to hate. It's a source of news and views, ones that might be at odds with our own, where we can freely find and share information. It is that very freedom that is now under threat, with democratic governments leading the charge.

    Canada's government has said that controlling Internet content is vital to protect democracy and social cohesion and has pointed to the January 6 insurrection in Washington, D.C., which by all accounts was organized online. It has crafted several laws to protect us from potential danger.

    Of course, Bill C-26, which is one of them, is to provide a framework for the protection of the critical cyber-systems that really are vital to national security and public safety. Bill C-26 allows Canada to take strong action against threats to the security of its telecommunications sector, but also so very much more. To start, it applies to six critical infrastructure sectors, but that is just the start.

    As referenced by Ms. Baron, any service, system and class of operator can be designated as a vital service or system. Every company is at risk of falling under the bill's sweeping powers, and being required to do, or refrain from doing, anything they are ordered to do, such as create back doors and break encryption or go on a fishing expedition to find whatever information the government wants—including what's in your emails and your texts, your cellphone and vehicle locations, purchaser or purchasing information, or donor details—so that it can make an order. The order will be secret until the target realizes something is up, because just disclosing the existence of orders made under this bill will be illegal.

    With a nod to eastern European regimes 100 years ago, this bill lets the minister compel any person, under threat of punitive fines, to provide any information, within any time, subject to any conditions that might be specified, or authorize anyone to enter and seize any information and systems, but without the checks and balances that are a mainstay of democracy.

    Notably, there is no requirement for those timelines or conditions to even be achievable. The bill does not limit compelled information to corporate or operational. There is reason for that, but it provides a dragnet for unsupervised collection, use, and broad disclosure of personal information, threatening individuals' privacy and making it impossible for organizations to comply with privacy laws or provide accurate responses to access to information requests.

    Sadly, the bill makes no mention of consulting the Privacy Commissioner to ensure that personal information is adequately safeguarded. While the bill specifies that corporate information may be designated as confidential, it offers no such consideration for personal information. The bill's vague language opens the door to telcos and ISPs being given unreasonable orders to spy on or deny service to any person, company or group whose conduct or commentary the government deems a threat to the security of Canada.

    To encourage voluntary compliance, the penalties are steep and unaffordable by all but the largest of organizations. In the manner of the Salem witch hunts, anyone who fails to pay the penalty or dispute the notice, and anyone who does pay, is “deemed to have committed the violation”. Either way, businesses pass their costs and fines along to consumers, so penalties will reduce competition by eliminating organizations that can't afford the fines. Consumers will end up covering the penalties paid by those that are large enough to afford them.

    Incentives like that can be a strong motivator. Some would call it coercive, since companies and people eager to retain their hard-earned money and avoid fines are easily nudged to simply do as they're told, while the government will be shielded from claims of overreach, since it won't be the government but the organizations voluntarily complying with orders that will be the ones violating charter-protected freedoms.

    In our view, allowing Bill C-26 to become law in its current form, and granting elected representatives and unelected bureaucrats overly broad and unaccountable authority, will further undermine public trust in the government, public service and federal institutions, and further foster a technocracy built on Sir Tim Berners-Lee's brainchild. Canadians deserve better.

    We would be happy to help by providing additional information and suggested amendments.

    Thank you, Ms. Polsky. You are right on time.

    We will go right into questions.

    Members, with the time we have, you will have four minutes each. There'll be a hard stop on your questions.

    We're starting with Mr. Shipley, please.

     Thank you, Chair.

    I would like to start with Ms. Baron. I want to give you an opportunity to finish your opening remarks here first.

    I really appreciate that.

    What I wanted to mention is that I think it's important that the bill be amended to allow procedure for special security-cleared advocates, which are used of course in the immigration context. We've actually suggested they should be allowed in the Emergencies Act context, just to follow up on a conversation today.

    A provision for security-cleared advocates is an imperfect solution for due process, but they would be allowed to test the evidence brought forward in these secret hearings. These advocates would have top secret clearance to allow a minimal check procedurally on applicants' rights.

    Thank you.

    I was scribbling down some notes during your opening remarks as well as I could. You mentioned service being cut off. Could you expand on that? I didn't quite get all of that. Was it individual service, such as their cell service, or was it companies? What did you mean by that? Can you expand on those points?

    Since the bill allows the minister to do anything or to prevent a person from doing anything, the understanding is that this could allow the government to issue an order to a telecom provider to cut off the Internet service of companies or of private individuals if, for example, they believed or even had evidence that their service was compromised or was being used to target a government website or was being used for some other improper procedure.

    Thank you.

    You also mentioned that you had some surveillance concerns and said there was some need for guardrails against abuse of these new powers.

    Can you expand on what those surveillance concerns are?

    Yes.

    Again, the bill empowers the government to secretly order telecoms to do anything or refrain from doing anything, which raises the clear spectre of imposing surveillance obligations on private companies as well as possibly weakened encryption standards.

    Thank you.

    I would like to ask Ms. Polsky something.

    You mentioned that this applies to six critical infrastructure areas. We have had some other people saying that this is not enough. Following on your opening remarks, do you figure that six is too few or too many?

    I think as it is now and actually as the critical infrastructure categories were defined just after September 11, anything could be construed to fall under one or more of those categories. They are very broad and not really very well defined.

    Anything has economic value. Many things have implications for transport. I think it's not a matter of defining the categories so much as looking at what the threats are and what the implications of the legislation as drafted could be.

    Thank you.

    I have a quick follow-up.

    You mentioned about the minister's control too. I believe you said there was permission for them to enter and seize and that there need to be some checks and balances. Did you want to expand on that statement?

    Certainly.

    From our understanding, the legislation allows for anybody to be appointed as an inspector. That person would have the power to enter any premises, short of a residence, without a warrant. They can seize anything. There is no limit. There's no requirement that it be related to a certain complaint or concern. It's open-ended.

    Thank you.

    We're going to move onto Mr. Schiefke, please.

    Thank you very much, Mr. Chair. I would like to add my thanks to the witnesses for being here today in person and virtually.

    Mr. Shull, I want to start with you.

    First, thank you for using your opening remarks to provide solutions and ideas. In fact, that's why we're here. We're looking for ways to improve on Bill C-26 and ensure that we have a bill that protects Canadians while also ensuring that we protect their constitutional rights.

    My first question for you is with regard to mandatory reporting for affected sectors and when there's a cybersecurity incident. Why is it important that we have that mandatory reporting?

    There are two or three different reasons.

    The first is that it allows CSE or the Cyber Centre to take action.

    The problem is that many of the critical sectors are targeted by state-level actors, and I've got news for you: If someone swipes in with a military badge on the other side and goes after a civilian structure, they're going to get in.

    You can take a briefing from CSE on this: Adversarial states are loading up our critical infrastructure with malware. They are pre-positioning in the case of a conflict. That's bad. To the extent that we can increase the efficacy of government agencies on those networks, we should, against when something bad happens.

    The second point is that it increases visibility across the network.

    Third, it allows for the spreading of best practices. If there's an exploit that's used, let's make sure it only gets used once.

     Thank you for that.

    The next question I'm going to ask is for Ms. Polsky and Ms. Baron. I'll ask each of you for responses. If you could keep them quick, that would be great. I only have four minutes.

    The first question is whether you would support the inclusion of a reasonableness standard for both cybersecurity directions and telecommunications systems orders.

    I'll start with you, Ms. Polsky.

    The short answer is yes. It needs to be there.

    Yes—given that it's a normal, robust reasonableness standard, absolutely.

    Thank you.

    The next question for both of you is whether you would support clarifying the scope of the ministerial order-making power by changing wording found in the bill from “do anything” to “do a thing specified in the order”.

    I'll start with you, Ms. Polsky.

    It currently states, “do anything”. Would you support a change to “do a thing that is specified in the order itself”?

    To suggest “do a thing that is specified in the order”, we could hope that this would limit it. Unfortunately, in my experience and in discussions with law enforcement, with members of the bar and bench and, frankly, some of your colleagues, they admit they don't get it. They don't understand it. I'm talking about technology and artificial intelligence and the implications and unintended consequences of some of the legislation that is being promoted now.

     To say “limit it” when the judges don't have to have any education about these matters.... They can be presented with whatever you want and be bamboozled, really and truly.

    Ms. Baron, would you comment?

    I would say that it also sounds like it would not build in any concept of proportionality to do anything specified in the order. I like it more than “do anything” or “refrain from doing anything”, but it sounds like it could also be quite unmoored.

    The chair looks very generous today, so I'm going to ask one more question, if I may. Would you support establishing a list of factors that must be considered before an order can be issued?

    I'll turn it over to you, Ms. Polsky.

    Yes, but who's going to create that list, and what are their motives?

    Thank you.

    Ms. Baron.

    Yes, assuming that broad consultation of stakeholders will precede that.

    Thank you both.

    Thank you, Chair.

    Thank you.

    Ms. Michaud is next.

    Thank you, Mr. Chair.

    Thank you to the witnesses for giving their valuable time to be here with us on this study.

    Mr. Shull, I liked your opening remarks. You cut to the chase, as they say. I appreciate that.

    I've spoken to a few groups outside this committee, and most of them think that Bill C‑26 is a great step forward. Overall, they feel it's a good thing.

    However, they have two key criticisms.

    First, they are criticizing the fact that government is being given a great deal of power. This bill gives certain ministers the freedom to issue orders in council and interim orders, but it doesn't necessarily provide any details on that. We don't know how that might look.

    Second, they find the sanctions too severe. You talked about tax incentives. If I'm not mistaken, rather than imposing sanctions, you're proposing that tax benefits or incentives be put in place for companies that would be required to set up a cybersecurity framework, for example. You look at the issue from another angle: We should make participation a little more voluntary, while ensuring compliance and making sure the information exchanged is protected.

    Can you tell us a little more about that?

     Mr. Chair, that's a great question.

    What I'm talking about is small and medium-sized enterprises and protecting them, as opposed to critical infrastructure providers that are defined in the act. It allows you to take federal jurisdiction by using your tax power to protect the companies that make up the bulk of our economy. Critical infrastructure is super-important, because...well, it's critical, and if it goes down, people are going to know about it.

     The problem we have is that many companies that are not critical infrastructure providers are being robbed through ransomware. Enough is enough, and a tax credit would provide that incentive.

    It's a good question, Mr. Chair.

    What would you suggest: Should we replace the sanctions with tax incentives or leave the sanctions in place?

    I'd leave the sanctions in place. Your point is a good one. There's almost an internal inconsistency in the bill, because they say that the administrative monetary penalties are to encourage compliance, but those penalties can be up to $15 million a day. This is not meant to be punitive, but they can fine you $15 million a day. It sounds pretty punitive when you think about it that way.

    All that is to say I would leave the penalty structure in place as currently defined for critical infrastructure providers. I would add on the incentive structure for small and medium-sized enterprises that do not fall within the statutory definition of critical infrastructure providers.

    You're talking about small‑ and medium-sized enterprises. Some are afraid of the additional paperwork it might involve. As we know, cybersecurity is evolving very rapidly. If they have an incident, for example, they have to meet the deadlines for sharing the information with the government. This is all in addition to the security and confidentiality of the information. Businesses have concerns about that. However, I haven't been able to get many answers from the government to reassure them.

    What do you think we should say to those companies? Are their concerns justified?

     Again, it's a great question, Mr. Chair.

    I'm personally a bit unconvinced by the regulatory burden argument. All the bill is saying is that if you work in critical infrastructure, you need to have a plan in place. You need to have a cybersecurity plan. The opposite of that is not having one, which is unsatisfactory. Then, if something happens, they have to report it. If they don't comply with that requirement, there's a penalty for not doing so.

    While I appreciate that there is some regulatory burden, there is a lot of regulatory burden on businesses all over the place. In this one, you're providing a critical function in the economy and you need to have your crash helmet on. If not, there are consequences, because the role you're playing is just too important for it to be left alone.

    Thank you.

    Thank you, Ms. Michaud.

    Our final questioner is Mr. Julian.

    Mr. Chair, could I interrupt?

    I'm sorry, Mr. Julian. It's a very quick point of order.

    I know that as members of Parliament, we're away from friends and family a lot, so I want to take this opportunity to wish Ms. Michaud a happy birthday today. I know she's here with us and I want to say happy birthday in public.

    Happy birthday.

    Mr. Julian, please continue.

    A voice: As a special gift, we won't sing.

    I'm going to take my four minutes. At the end, I think we should be singing to Madame Michaud. I'll hold that until four minutes from now.

    Mr. Chair, I think we all had questions for Mr. Neiman and Mr. Holland, so I'm hoping we can have them back at committee. I know that's an additional expense because of the Conservative filibuster, but it's critical to get this legislation right. I appreciate the witnesses who've been able to answer our brief questions. We have many more questions to ask.

    I want to come to Ms. Polsky and Ms. Baron.

    You're part of the coalition that provided an excellent joint submission that talks about recommended remedies. There are 16 recommendations on how this committee can improve the legislation. They touch on a number of areas: “restraining ministerial powers”; “protecting confidential personal and business information”; “maximizing transparency”; “allowing special advocates to protect the public interest”; and “enhancing accountability for the [Communications Security Establishment]”.

    Of the 16 recommendations, which are the most critical ones that we need to consider, or are they all part of a package—something vital to make sure this legislation does what it's intended to do but does it in a transparent way?

    I'll start with Ms. Polsky.

    Thank you. I think you hit on the key, transparency.

    It's not a matter of one being more or less important than the other. They all have to be present for the legislation to be reasonable, fair and balanced, and for it to deserve the public's trust. They all have to be incorporated into legislation. It's as simple as that. Without all those components, there aren't the balance, reasonableness and proportionality that have to be there.

    What I hear you saying is that the 16 recommendations are all interlinked. Without all of them, you and the coalition would not be prepared to support the legislation.

    The premise of the legislation is important, but there's an old saying: “You can't lose fast enough.” I think it's incumbent on us all to take the time and do it right—not do it over or have people suffer as a result of legislation that could have been done right in the first instance but is now perhaps being rushed through.

    Thank you for that.

    Mr. Baron, I have the same question for you.

    Of the 16 recommendations, which are the ones you feel are most critical to get right in this legislation?

     We've been discussing these various remedies for several years now—the civil liberties groups—and I agree with Ms. Polsky that I can't pick a favourite child. I would say that all the recommendations, overarching, have the same purpose of proportionality, privacy and checks on the exercise of unconstrained power. They go together as a package.

     I couldn't single one out. If I did, it would be one that I have particular expertise in, but that doesn't mean it's the most important for the goal of cybersecurity, which we all agree is an absolute imperative.

    Thank you. My question was more on what is absolutely critical. Where is there a line in the sand in terms of ensuring this legislation is right? What I hear both of you saying is that all of the recommendations are critical. I thank you for that.

    My four minutes are up, but I think I would join the rest of the members in singing Happy Birthday to Ms. Michaud.

    Some hon. members: Hear, hear!

    Thank you, committee.

    Thank you, witnesses. We appreciate your time. I will mention to the witnesses that there may be some additional questions, because your time was limited. If there is anything else you would like to submit to the committee, we'd appreciate it.

    Go ahead, Mr. McKinnon.

    Mr. Chair, I would like to underscore that, but I also would like to invite the witnesses to augment whatever submissions they've done with any specific amendments that they would like to suggest. I think that would be most helpful going forward.

    Thank you.

    The meeting is adjourned.