Senators amend error in cybersecurity bill that could have cancelled half of it

It could take a while yet for the federal government's cybersecurity bill to become law after the Senate caught an error that essentially would have nullified half of what the legislation sets out to do.

The Senate voted Thursday to amend the bill to fix what's been described as a human error.

While in the grand scheme of things the amendment is a technical fix, the legislation will have to be sent back to a gridlocked House of Commons for another vote — prolonging a process that has taken more than two years already.

"Which is unfortunate, because of how important this legislation is," said non-affiliated Sen. Patti LaBoucane-Benson while introducing the amendment earlier this week.

She urged both houses to pass the bill before the end of this parliamentary session.

"Canada's telecommunications systems and critical infrastructure face unprecedented and growing cyber threats from state and non-state actors around the world," she said.

"Canadians rely on these systems for our well-being."

Bill C-26, first introduced in 2022, would introduce new cybersecurity requirements for federally regulated industries and codify national security requirements for the telecommunications sector.

It's broken into two parts. The first section amends the Telecommunications Act to give the federal government "clear and explicit legal authority" to prohibit Canadian telecoms from using products and services from "high-risk suppliers."

The government — citing national security concerns — said at the time it would use those powers to bar Canada's next-generation mobile networks from using products and services from Huawei and ZTE, two Chinese state-backed telecommunications firms.

The second portion of Bill C-26 introduces the Critical Cyber Systems Protection Act. It would compel companies in vital, federally regulated sectors such as finance, telecommunications, energy and transportation to either shore up their cyber systems against attacks or face expensive penalties.

It's not clear how quickly House can tackle amended bill

As CBC reported last week, that whole second section would — without a change to the text — be annulled the minute it passed royal assent and became law. That's because the government's foreign interference law Bill C-70 was meant to repeal and supersede a small section of Bill C-26.

Due to an amendment a House of Commons committee made, Bill C-26's clauses were renumbered without much notice.

So instead of repealing one small section of the cybersecurity bill, the foreign interference law — which was fast-tracked through Parliament this spring — actually repeals the entire second half of Bill C-26, the cybersecurity portion. 

If the error had gone unnoticed, it would have repealed the "vast majority, the most operative provisions" of Bill C-26, said Conservative Sen. Denise Batters.

She said she wants to know how to prevent things like this from happening in the future to government bills.

"As a human being, I think mistakes will be made," said Independent Sen. Hassan Yussuff, chair of the Senate's national security committee, in the Senate on Wednesday.

"The embarrassment of it is enough to give them some recognition that they need to do a better job."

It's not clear how quickly the House will be able to deal with the cybersecurity bill. The Conservatives, with the support of the other opposition parties, have been holding up business in the Commons as they demand the Liberal government release all unredacted documents related to a failed green technology scheme.

Despite the weeks-long deadlock in the House, Jennifer O'Connell, parliamentary secretary to Minister of Public Safety Dominic LeBlanc, said in a media statement she hopes to see the bill move through quickly.

"This bill focuses on protecting Canadians and [that's] why it was supported unanimously in the House of Commons," she said in a media statement.

"I hope all parties can work together in the same spirit to ensure this bill becomes law."