Regulating TSPs, not suppliers, in cybersecurity bill will be ineffective: Telus exec

MISSISSAUGA — Telus Corp.’s vice president and chief security officer said the government’s cybersecurity bill is ineffective in that it attempts to regulate supplier behavior by regulating the telecommunications service providers (TSPs). Carey Frey made the remarks Tuesday at the 2022 edition of the Canadian Telecom Summit during a cybersecurity panel which touched on many subjects including Bill C-26, An Act Respecting Cyber Security (ARCS), introduced by the government in June. Frey said it is too early to assess what the impacts of Bill C-26 will be on Telus and other service providers but offered some preliminary thoughts on the legislation, specifically the regulation of TSPs. “They don't want to regulate the equipment manufacturers or the hyperscalers… potentially, because they don't want to take on the market power. So they're trying to regulate them indirectly via our behavior in terms of how we interact with those suppliers,” he said. Part of the bill revolves around changes to the Telecommunications Act, and would add a policy objective “to promote the security of the Canadian telecommunications system,” and would give federal bodies authority to take “security-related measures” in the telecommunications sector. Part of that list includes the ability to prohibit a TSP from using any specified product or service in relation to its telecommunications network or telecommunications facilities. Federal bodies would also be able to direct a TSP to remove a product, prohibit it from entering into a service agreement for any product, impose conditions on the use of a product, or terminate a service agreement. “I don't think that's going to be a particularly effective regulatory framework,” Frey said. Amendments to the Telecommunications Act also include a provision which states that in the case of a threat against Canada’s telecommunications system the minister of industry, in consultation with the minister of public safety and emergency preparedness, may direct an ISP to suspend, or prohibit an ISP from providing, any service to any specified person, including a TSP for a specified period. Critics of the bill have sounded the alarm over that particular provision. “I think it's just as simple as it's not necessarily understood what the impacts are of making a decision like that,” Frey said. “I don't think we have to be worried that a measure is going to be imposed that will result in a carrier going and literally flicking off a switch the next day and crippling a part of their network or part of their customers' capabilities.” Frey also said that the telecommunications sector and government already have a strong private-public partnership when it comes to managing threats and the bill is simply formalizing that. He said that worry would only be warranted if that relationship becomes adversarial rather than cooperative. “I would hope that if our federal government, or their partners in the world, knew that there was a threat in terms of our networks or something that we were doing, they would just come to us and say, ‘here's this threat, you need to do something.’ And I would expect that we would just do it. I think in like 99.9 per cent of cases that's how the system has been working for close to 20 years, and it's how it's going to continue to work.” Executive director of Global Privacy and Security by Design Centre Ann Cavoukian, who also spoke at last year’s summit on C-26’s predecessor bill, C-11, said that a provision to remove services is “excessive.” (Bill C-11 died on the floor when the 2021 election was called.) “I personally think that expecting telcos to remove services, based on the belief that they're only a threat to security – I don't think that would be fair to either the users of the service or the telecoms. So I think there has to be something to substantiate this,” she said. “Certainly protections should be built. Security, we want to safeguard security, we want to safeguard privacy… but just to cut the service off just like that without any substantiation, in my view, is excessive.” – Reporting by Jenna Cocullo at jcocullo@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Regulating TSPs, not suppliers, in cybersecurity bill will be ineffective: Telus exec

News | November 22, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Regulating TSPs, not suppliers, in cybersecurity bill will be ineffective: Telus exec

News | November 22, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Online harms and more in focus as Parliament returns

Telecoms and broadcasters hit by CrowdStrike IT outage

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us