On June 14th, the Canadian government tabled a new bill which will require all businesses and other private sector organizations to report ransomware incidents and cyberattacks to the CSE ( Communication Security Establishment) under a new federal bill. Including prohibiting Canadian companies from using products and services from high-risk suppliers.
The act eliminates the liberal government from protecting critical infrastructures experiencing a cyberattack. In return, we gain a better understanding of each attack, establishing a better framework to better shield systems vital to national security and give the government a new tool to respond to emerging dangers in cyberspace.
If an organization refuses to report all cybersecurity and digital attacks, it will face a federal penalty.
The Canadian government is already on high alert for Cyber-attacks by Russia and others amid global threat environments; Public Safety minister Marco Mendicino has stated, “the threat is not just to the federal government but also provinces and critical infrastructures.”
In that announcement, it was clear that all organizations were not required to report any cyber-attacks; now, the circumstances have changed.
In the last six months, Canadian critical infrastructure and governments have been with repeated cyberattacks, including Toronto’s Humber River Hospital, the Toronto Transit Commission, the City of Saint John in New Brunswick, and the Newfoundland and labrador health industry.
To prevent public display, organizations have preferred to pay the fee demanded to make the problem disappear quietly, making it difficult for officials to get a complete picture.
Now organizations must report and communicate all Cybersecurity attacks to the CSE within 72 hours.