Strengthening Cyber Defenses
Canadian Government Bolsters Critical Infrastructure Cyber Security with Royal Assent of Bill C-8
Canada's Bill C-8, known as the *Act Respecting Cyber Security* (ARCS), received Royal Assent on June 15, 2026, at 8:25 PM, officially becoming law Public Safety Canada. The legislation gives Ottawa sweeping new powers to protect the country's most vital digital systems — from banks to power grids to phone networks.
Ministers Gary Anandasangaree and Melanie Joly marked the occasion in Ottawa on June 16, calling it a critical step to defend Canadian infrastructure National Post. The law arrives as cyber incidents targeting critical infrastructure rose 20% year-over-year, with the average ransom paid by Canadian organizations hitting $1.1 million in 2023 — a 150% jump in just two years National Post.
Four Years of Debate, Two Parliaments, One Law
The road to ARCS began in June 2022, when the Liberal government introduced Bill C-26 in the 44th Parliament Northern News. That bill died when Parliament was prorogued in December 2024. The government reintroduced it almost unchanged as Bill C-8 in June 2025, signaling it was not willing to let the work expire again.
The path was not smooth. In March 2026, the Speaker of the House ruled Conservative amendments — which would have required a judge to approve government security orders before they took effect — out of order The Observer. The bill passed Third Reading on March 26, 2026, and the Senate adopted it without major changes on June 4, 2026 The Observer.
New Rules Force Banks, Telcos, and Energy Firms to Act
ARCS creates two major changes. First, it amends the *Telecommunications Act* to make security an explicit policy goal — a law written in 1993, before state-sponsored hacking existed The Whig. Second, it introduces the *Critical Cyber Systems Protection Act* (CCSPA), which forces companies in four sectors to build and maintain cyber security programs: telecommunications, finance, energy, and transportation.
Once a company is formally designated under the law, it has just 90 days to implement a Cyber Security Program, according to analysts at KPMG. The government can also now legally order the removal of specific vendors — such as Chinese state-backed firms — from any part of a critical network. Non-compliance can trigger fines of up to $15 million per day under the telecom amendments Cochrane Times Post.
Critics Warn of Secret Orders and No Judicial Checks
Privacy advocates and legal experts have raised sharp concerns. The law lets the government issue security orders to companies in secret. Those companies are then forbidden from telling the public they received an order at all Hanna Herald. OpenMedia, a digital rights group, called this a form of
placeholder
Sentiment
NeutralPublishers
9
Articles
9
Reach
9
