Allied Intelligence — 2026-06-10

Citizen Lab Warns Canada Bill C-8 Has Constitutional and Cybersecurity Deficits in National Security Surveillance Powers

BLUFOttawa likely will issue its first binding supplier-prohibition order within a year of royal assent, but broad ministerial discretion leaves enforcement vulnerable to constitutional challenge before courts settle the boundaries.

The Canadian Senate on June 5 passed Bill C-8, a mandatory cybersecurity framework for critical infrastructure across telecommunications, finance, energy, and transportation sectors, with royal assent pending 1. The bill grants the Governor in Council and Minister of Industry authority to issue binding orders to telecommunications providers, prohibit products from specified suppliers, and mandate removal of high-risk equipment from domestic networks 1. On May 25, Citizen Lab senior research associate Kate Robertson testified before the Standing Senate Committee on National Security that the bill creates warrantless powers to collect personal and de-identified data from telecommunications companies without federal court oversight, and that its ordering authorities risk compelling providers to compromise encryption in domestic networks 23. Canada's Privacy Commissioner separately warned that legal thresholds for the new powers are too broad, that no mandatory breach-notification mechanism exists, and that privacy standards for information-sharing with foreign governments are inadequate 1.

Analysis
Ottawa accepted legal risk for speed: passage over formal Citizen Lab and Privacy Commissioner objections invites judicial challenge once enforcement begins. Robertson's Senate testimony is the primary source; secondary outlets added no independent reporting. Canada is likely to issue at least one binding prohibition order naming a specific supplier within twelve months of royal assent, driven by Five Eyes alignment and intent to close the Huawei gap peers addressed years earlier. Analytic confidence is moderate: statutory authority and political will are documented, but timing and target depend on internal processes outside open-source visibility. Courts may extend broad national security deference to ministerial discretion, rendering the constitutional objections moot and forcing Canadian telecom operators to accelerate equipment replacement and procurement without further regulatory cover.

3 sources

Canada parliament passes cybersecurity bill amid privacy concerns - JURIST
Submission to the Standing Senate Committee on National Security Defence and Veterans Affairs of Bill C-8 - Citizen Lab
Bill C-8 Senate Brief — Citizen Lab (Kate Robertson) - Senate of Canada