Senators amend error in cybersecurity bill that could have cancelled half of it

It could take a while yet for the federal government's cybersecurity bill to become law after the Senate caught an error that essentially would have nullified half of what the legislation sets out to do.

The Senate voted Thursday to amend the bill to fix what's been described as a human error.

While in the grand scheme of things the amendment is a technical fix, the legislation will have to be sent back to a gridlocked House of Commons for another vote — prolonging a process that has taken more than two years already.

"Which is unfortunate, because of how important this legislation is," said non-affiliated Sen. Patti LaBoucane-Benson while introducing the amendment earlier this week.

She urged both houses to pass the bill before the end of this parliamentary session.

"Canada's telecommunications systems and critical infrastructure face unprecedented and growing cyber threats from state and non-state actors around the world," she said.

"Canadians rely on these systems for our well-being."

Bill C-26, first introduced in 2022, would introduce new cybersecurity requirements for federally regulated industries and codify national security requirements for the telecommunications sector.

It's broken into two parts. The first section amends the Telecommunications Act to give the federal government "clear and explicit legal authority" to prohibit Canadian telecoms from using products and services from "high-risk suppliers."

The government — citing national security concerns — said at the time it would use those powers to bar Canada's next-generation mobile networks from using products and services from Huawei and ZTE, two Chinese state-backed telecommunications firms.

The second portion of Bill C-26 introduces the Critical Cyber Systems Protection Act. It would compel companies in vital, federally regulated sectors such as finance, telecommunications, energy and transportation to either shore up their cyber systems against attacks or face expensive penalties.

As CBC reported last week, that whole second section would — without a change to the text — be annulled the minute it passed royal assent and became law. That's because the government's foreign interference law Bill C-70 was meant to repeal and supersede a small section of Bill C-26.

Due to an amendment a House of Commons committee made, Bill C-26's clauses were renumbered without much notice.

So instead of repealing one small section of the cybersecurity bill, the foreign interference law — which was fast-tracked through Parliament this spring — actually repeals the entire second half of Bill C-26, the cybersecurity portion.