Coming cyber-security legislation to affect telecoms, but details scant

The government will introduce new legislation aimed at strengthening the security of “Canada’s essential cyber systems” that will impose new obligations on telecommunications companies, though exactly how or when the rules will change remains to be seen. The government will spend $36.4 million over five years on “protecting vital cyber systems,” the federal budget, released Tuesday, stated. “Following consultations, new legislation will require operators of vital cyber systems to implement cyber security plans, meet robust security outcomes for their systems and report cyber security incidents to the Government of Canada,” budget documents said. “Building on the efforts of individual operators of vital cyber systems to secure their own systems, Economic Action Plan 2015 funding will provide enhanced support to operators through the development and dissemination of cyber security tools, security information and expertise to implement the new legislation.” The government also said it would provide $58 million over five years to “further protect the Government of Canada’s essential cyber systems and critical infrastructure against cyber attacks.” Public Safety Canada spokeswoman Josée Sirois said in an email the legislation would apply to “private-sector, federally-regulated, cyber systems,” including the telecommunications sector. “These efforts are intended to build on the well-established work of vital cyber system operators, and to enhance collaboration required to secure essential systems in Canada," she said. "The operators of vital cyber systems would be supported through the availability of cyber security tools, cyber threat and vulnerability information, and guidance from the government." Sirois added: “A transparent and inclusive consultation will follow the tabling of the bill." She declined to give a timeline for when the legislation would come forward. According to a post this week on McCarthyTétrault LLP’s CyberLex blog, the budget provides the “first glimpse” into the Protection of Canada’s Vital Cyber Systems Act, which the government has been working on for nearly a year. The blog noted that the “measures are a timely implementation” of Canada’s cyber-security strategy, which was introduced in 2010, and said the new initiatives “should change the cybersecurity landscape in Canada for years to come.” Public Safety's Sirois would not confirm any tentative name for the legislation. The McCarthyTétrault blog added: “The 2015 budget signals the significant role that cybersecurity will play in the remaining months of this government’s term. However, an assessment of the impact of this cybersecurity policy on businesses will have to wait until the Bill is tabled before Parliament.” Tamir Israel, a lawyer with the Samuel-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC), said investment in cyber security is needed. “The good side is obviously the fact that they’re investing in hardening targets, because that is something that definitely needs to be done in a really serious way,” he said in a phone interview. “More and more of our information is behind critical infrastructure and technical systems, and they’re exposed to increasing degrees, and the security side of them — making the targets a little tougher to get into — is not getting the amount of attention and the resources it needs.” At the same time, the requirements regarding telecoms sharing information about breaches with governments invite some concerns about privacy, he said, explaining that in the U.S. there have been some overly-broad legislative attempts that were not successful, such as those “allowing companies to just hand over the entire data set without making any attempt to limit the privacy implications.” For instance, an ISP that gets attacked could make sure to extract the irrelevant content of customers’ email before passing on information about a data breach to the government, he said. “The easier way is just to give them everything, and then once its handed over, it goes into their increasingly integrated databases, and it often goes to security agencies directly,” he said. “The concern is that all these breaches are now going to feed into the already quite expansive intelligence-gathering and profiling databases of these agencies.” The extent to which the measures announced by the government will change the status quo for telecoms seems unclear at this point, Israel said. “I would say most of this is probably already there." Israel noted that, “arguably,” obligations to secure systems already exist under the Personal Information Protection and Electronic Documents Act (PIPEDA), but that they are not well enforced because that legislation has few “penalties for ignoring it.” “That’s the main problem with that statute … but the obligation is already there and it’s a legal obligation,” he said. Additionally, the Digital Privacy Act or Bill S-4, would amend PIPEDA to include “an obligation to report breaches of security safeguards” to the privacy commissioner and other government agencies, Israel said. He said it would be good if the new legislation improved on the reporting requirements in S-4, which would only apply to breaches at a certain threshold. S-4, which passed at committee this week, is not yet law, and so “the way that it stands right now is that there’s no obligation to report,” Israel noted. “So companies, when they’re doing a cost-benefit analysts of whether to invest in safeguards … as well as how to deal with a breach when they uncover it, they know there is no obligation to tell anyone. The chances of people finding out are actually relatively low,” he said. “As much as we hear a lot about breaches, the tip of the iceberg is what we hear about. There’s all the other ones that we don’t hear about. So there is little incentive to actually put in place strong safeguards because it could be costly.” — With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Derek Abma at dabma@thewirereport.ca

Coming cyber-security legislation to affect telecoms, but details scant

News | April 24, 2015

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Coming cyber-security legislation to affect telecoms, but details scant

News | April 24, 2015

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Champagne announces launch of Canadian AI Safety Institute

Satellite is ‘here to stay’ as connectivity solution, industry players say

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us