Commons Record: The Cybersecurity Bill Is Just Legislative Scaffolding

Why the debate over Bill C-8 reveals the messy, necessary process of building a law, not just passing one

Sep 27, 2025

On September 26, 2025, the House of Commons began debating Bill C-8, an act to protect Canada’s critical infrastructure from cyber threats. To an outside observer, the proceedings might seem like a frustrating exercise in political theatre. The government presented a clear problem, cybercrime, and a seemingly straightforward solution. The opposition parties, while agreeing with the problem, immediately began picking the solution apart. Your frustration with a process that appears to complicate an obvious need for action is understandable. It feels like watching architects argue over window trim while the foundation remains unpoured.

This feeling, however, comes from a common misconception about how our system works, especially in a minority parliament. A government bill is not a finished product presented for a simple up-or-down vote. It is an opening proposal. The debate that follows is not an obstruction of the work, it is the beginning of the work itself. The proceedings of September 26th were a public inspection of the government’s blueprint, a process that revealed critical flaws before the construction crews were called in. Understanding this distinction is the first step toward transforming your frustration into civic agency.

The Government’s Polished Blueprint

The Minister of Public Safety, Gary Anandasangaree, opened the debate by laying out a compelling case for urgency. He described a landscape of “unprecedented cyber-threats,” citing the Communications Security Establishment’s warning that cybercrime is the “most prevalent and pervasive threat to Canadians.” He grounded this abstract threat in tangible, recent examples: a ransomware attack that crippled the City of Hamilton in March 2024, a data theft incident at WestJet, and service disruptions at a Quebec food wholesaler and an Ontario hospital.

The proposed solution, Bill C-8, appears comprehensive. It seeks to amend the Telecommunications Act to allow the government to order providers to secure their networks, including banning equipment from high-risk suppliers. It also introduces the Critical Cyber Systems Protection Act, which would compel operators in four key sectors, finance, telecommunications, energy, and transportation, to establish cybersecurity programs and report incidents. The government presented this as a finished blueprint, a necessary and robust structure to protect the nation’s essential services.

Introducing Legislative Scaffolding

To make sense of what happened next, you need to abandon the idea of a finished blueprint. A better analogy is Legislative Scaffolding. When you see scaffolding around a building, you understand it is a temporary, functional structure meant to facilitate the real work. It is not the building itself. You expect to see workers adjusting it, testing its strength, and using it to access different parts of the project. A government bill, particularly a complex one like C-8, functions in the same way. It is a framework erected around a policy problem. The debate in the House is the initial inspection of this scaffolding, and the opposition’s job is to find the weak points before the real construction begins in committee.

The debate on Bill C-8 was a masterclass in testing the scaffolding. While all parties agreed on the need for the structure, they immediately identified three significant areas where the government’s proposal was unstable, unclear, or encroached on existing structures. The arguments were not about demolition, but about necessary reinforcement.

The Privacy Fault Line

The first and most significant weak point identified by all opposition parties was the bill’s impact on privacy. The proposed law grants broad new powers to the government, and the scaffolding of checks and balances appeared rickety. Conservative critic Frank Caputo noted that the bill gives the government power to compel companies to hand over information, but provides insufficient clarity on how that information will be used, shared, or stored. His colleague, Marilyn Gladu, pointed out that the Privacy Commissioner had suggested a specific amendment to the previous version of this bill, Bill C-26, which the government failed to incorporate into the new text.

NDP member Jenny Kwan drove the point home, highlighting the bill’s “vague, subjective” standard for sharing information. She raised the alarm that information could be shared between agencies or even with foreign governments based simply on a minister’s judgment of what is “necessary.”

“When we concentrate this much power in the hands of a single minister, we need checks and balances. Where are they in the bill?”

This points to a critical question. How do you build a security apparatus without creating a surveillance apparatus? The opposition’s unified critique suggests the government’s scaffolding lacks the necessary guardrails. They are not arguing against security, they are arguing for a design that does not compromise the fundamental privacy of the citizens it is meant to protect.

The Jurisdictional Collision

The second major issue exposed was one of jurisdictional conflict. The scaffolding, as designed, appears to clip through existing provincial structures. Bloc Québécois critic Claude DeBellefeuille provided a precise and compelling analysis of how Bill C-8 would interfere with Quebec’s authority over its own energy infrastructure. She explained that Hydro-Québec, which is entirely under provincial jurisdiction, already adheres to robust North American cybersecurity standards because it supplies power to the United States.

The proposed federal law, however, would impose a second layer of regulation, creating duplication and the potential for conflicting requirements.

“Under the guise of cybersecurity, Bill C-8 expands the jurisdiction of the Canadian Energy Regulator to cover the entirety of an international line, even the intraprovincial parts. In our view, the law should acknowledge the jurisdictions of the provincial regulatory agencies, like Hydro-Québec.”

Here is the detail I find most revealing. The federal bill designates the Canada Energy Regulator as the authority for vital energy systems, but as DeBellefeuille pointed out, no power lines in Quebec are currently under the jurisdiction of that federal body. This is a direct collision of jurisdictions. The debate revealed that the government has erected scaffolding that ignores the load-bearing walls of Canadian federalism. The Bloc’s argument is a demand to redesign the framework to connect with provincial structures, not bulldoze through them.

Who Pays for the Project?

The final weakness exposed was the question of cost. The scaffolding is up, but who is going to pay for the materials and labour to finish the building? The bill is clear: there will be no compensation for companies ordered to comply. If a telecommunications provider is directed to rip out and replace millions of dollars worth of equipment, that cost is not borne by the government.

As multiple members pointed out, these costs will inevitably be passed on to consumers. This transforms a national security imperative into a hidden tax on Canadians’ phone and banking bills. The debate forces a crucial principle into the open: the costs of collective security should be shared collectively, not downloaded onto individuals and businesses through regulatory mandate. The opposition is not questioning the need for the renovation, they are questioning the government’s inequitable funding model.

Beyond the Scaffolding

The debate over Bill C-8 is not a sign of a broken system. It is a sign of a system that is working. It reveals that in a minority parliament, legislation is not a decree, it is a negotiation. The bill that was introduced is merely the initial proposal, the legislative scaffolding. The unified message from the opposition parties was clear: they will vote to approve the project in principle and send it to committee, but they will not approve the final construction until these fundamental design flaws are addressed.

Your sense of agency comes from understanding this process. The real work of building this law will happen in the Standing Committee on Public Safety and National Security. This is where the arguments you heard in the House will be translated into concrete amendments. This is where experts, industry stakeholders, and civil liberties groups will be called to testify and propose changes. The opposition parties have publicly committed to this work. The opportunity for influence is not over, it has just begun. A democracy is not judged by the confident presentation of its blueprints, but by the strength and integrity of what it builds after the arguments are done.