Fate of cybersecurity bill targeting Huawei uncertain after senator finds 'drafting error'

The future of a Liberal government bill meant to protect vital infrastructure from cyberattacks and enable Ottawa to ban telecommunications providers from partnering with what it considers risky vendors — including Huawei — is in doubt after senators studying the bill found what one senator called a "drafting error."

Bill C-26, first introduced back in 2022, has two key parts. The first section amends the Telecommunications Act to give the federal government "clear and explicit legal authority" to prohibit Canadian telecoms from using products and services from "high-risk suppliers."

The government — citing national security concerns — said at the time it would use those powers to bar Canada's next-generation mobile networks from using products and services from Huawei and ZTE, two Chinese state-backed telecommunications firms.

The second portion of Bill C-26 introduces the Critical Cyber Systems Protection Act. It would compel companies in vital, federally regulated sectors such as finance, telecommunications, energy and transportation to either shore up their cyber systems against attacks or face expensive penalties.

The bill has had a slow journey so far through Parliament and appears to have hit another roadblock.

Senators were prepared to do a clause-by-clause review of the proposed legislation on Monday. They paused that review when Independent Sen. John McNair, sponsor of the bill in the upper chamber, said he had been alerted to "drafting errors" in the bill with "potential significant impact."

The Senate's national security committee then moved in-camera to discuss.

A renumbering issue 

According to sources with knowledge of the file, one of the key goals of the bill — to introduce new cybersecurity measures — will be nullified if the draft isn't fixed.

That's because when the government wrote its foreign interference law Bill C-70, it made sweeping changes to the Canada Evidence Act. The foreign interference law was also meant to repeal and supersede a small section of Bill C-26 that also dealt with the Canada Evidence Act.

But sources — who spoke on the condition they not be named because they were not authorized to speak publicly — told CBC News that C-26's clauses were renumbered without anyone really noticing before now.

Because the section numbers no longer match, the foreign interference law, which was fast-tracked through Parliament this spring and is now law, actually repeals the entire second half of Bill C-26 — the cybersecurity portion. 

It's not clear what the next steps are. The Senate committee is meeting early next week to discuss the cybersecurity bill.

If senators feel they have to amend the bill, it will have to be sent back to the House of Commons, delaying an already delayed bill at a time when the lower chamber is gridlocked.

Matt Malone, Balsillie scholar at the Balsillie School of International Affairs, said the drafting hiccup reflects broader problems with Bill C-26,

"Especially in the way some of its broad and vague language leaves far too much room for government overreach," he said.

"A key flaw of Bill C-26 is the need for stronger oversight with the new order-making and information-collecting powers it grants the government."

Ottawa needs new law to enforce Huawei ban

Beyond the need to shore up vital systems against attacks, sources say there's also a concern about how a delay in passing C-26 might affect Canada's use of technology from Huawei and other companies red-flagged by the federal government.

While the government announced its intention to ban the use of Huawei and ZTE products and services more than two years ago, Bill C-26 gives it the legal authority to follow through.

In the federal government's own words, Ottawa will only be in a "position to apply these new order making powers" after the act receives royal assent and becomes law.

Ottawa originally asked Canadian companies to remove or terminate 5G equipment from Huawei and ZTE by June 2024. It also set a deadline of December 2027 for companies to get rid of existing 4G equipment provided by the two Chinese firms.

A source with knowledge of the file said the federal government reached out to the major telecommunication companies this summer for an update.

The source said all the major companies responded except for Telus Corp. 

CBC News also reached out to the three major telecommunications companies to see if they had removed any existing 5G Huawei equipment by the June deadline.

A spokesperson for Rogers said it launched a standalone 5G network in partnership with Ericsson and it's not affected by the Huawei ban. 

Bell also said the company does not use Huawei in its 5G network.

Telus did not answer CBC's question directly.

The company originally planned to roll out its 5G network using Huawei technology. Telus later announced partnerships  with Nokia, Ericsson and Samsung to build its 5G network.

"We remain and have always been compliant with current Canadian regulations, laws and cybersecurity requirements," Telus spokesperson Richard Gilhooley said in an email.

What's the worry about 5G?

New 5G networks promise to give people speedier online connections and provide the greater data capacity required to allow more people, and things, to connect online. Unlike previous generations, the technology that underpins 5G networks relies on multiple antennas to move signals around, bouncing them quickly between locations.

Critics have long warned that Huawei's participation in 5G networks, both in Canada and in allied countries, could give the company an inside look at how, when and where Canadians use internet-connected devices. Many have warned that the Chinese government could force the company to hand over that information.

China's National Intelligence Law says Chinese organizations and citizens must support, assist and co-operate with state intelligence work.

Huawei has long insisted it's an independent company that does not engage in espionage for Beijing.