Ottawa’s cybersecurity bill has ‘good bones’ — but secrecy rules need work, experts say – National

The federal government’s new legislation proposing sweeping new powers to direct cybersecurity for private sector critical infrastructure operators has “good bones,” according to experts.

But they warn that provisions in the bill to gag any operator from disclosing orders from the government to fix their systems — potentially requiring tens of millions of dollars in technical changes — could pose a problem for transparency with investors and basic public accountability.

“I think that the bill is incredibly well-intentioned. I think it parallels the efforts of many of our allies who are also taking critical infrastructure security seriously,” said Christopher Parsons, senior research associate at the Munk School’s Citizen Lab at the University of Toronto.

“That having been said … there’s potentially a high degree of secrecy that may be attached to some of the orders that are passed down by the government.“

Under the new legislation, the government wants the power to compel cybersecurity action from a new category of what it calls “designated operators” working in four federally-regulated sectors: finance, telecommunications, energy and transportation.

If passed, the legislation would let the federal cabinet “direct any designated operator or class of operators to comply with any measure set out in the direction for the purpose of protecting a critical cyber system.”

It adds: “Every designated operator that is subject to a cyber security direction is prohibited from disclosing, or allowing to be disclosed, the fact that a cyber security direction was issued and the content of that direction.”

There are no time limits on the prohibition, nor monetary threshold at which the cost of complying with a federal order would warrant the operator needing…