Summary

  • Ottawa can order equipment out of a telecom network. The law gives its owner no right to federal compensation for financial losses caused by making the order.
  • Who must act, who gets told and who can see the reasons depend on different rules. A separate critical-systems law does not start all its duties on the day it is passed.

A telecom operator buys equipment to carry calls and data, not to take it apart on someone else's instructions. Yet that is a possibility Canada's new cyber law puts on the balance sheet. Ottawa can order products removed from a network—and the law gives the operator no right to compensation from the federal government for financial losses caused by making the order.

For a company facing such an instruction, the awkward question would be how to keep providing a service while giving up part of what it bought to provide it. The government would have a security objective; the operator would still have an investment to account for. The law does not make the second problem disappear when the first becomes urgent.

This is a risk created by the legislation, not a report of a particular removal or loss. Nor does it establish that customers will pay more. What it does explain is why the small print matters beyond a carrier's legal department.

A power to change the network

C-8 received royal assent on 15 June 2026. The telecom amendments took immediate effect, according to Public Safety Canada. They allow restrictions on a supplier's products and services, including orders to remove products already in a network.

Removal is not the only tool. A minister can require a security plan, a search for weaknesses and measures to fix them, specified standards or backup systems. A security order can also take precedence over a conflicting decision by the telecom regulator, CRTC—but only for the conflicting part.

There is a test before those powers can be used. The Telecommunications Act requires an order to be necessary and reasonable in light of the threat's seriousness. It names operating and financial effects among the considerations. Keeping the service running and protecting privacy count too. In other words, the decision is not simply whether equipment presents a risk; the response needs a justification of its own.

An instruction the public may not see

An order may forbid disclosure of its existence or contents. That restriction is not automatic: the government must weigh the factors specified in the Act. But where it is imposed, outside readers cannot expect the same account as those with a legal right to be told.

For a non-secret order, the minister must send notice containing the order to the people named in it within seven days. For a secret one, two watchdogs—the parliamentary intelligence committee, NSICOP, and the review agency, NSIRA—must be told within 90 days that it was made. Those are different recipients, not two promises to notify the public.

Parliament gets a wider view through the annual report required by section 15.21. It must cover the number and nature of orders, affected providers, compliance, revocations and reasons. It must also identify conflicts with CRTC decisions. A separate report, under section 15.81, has a summary that must go online within ten days of presentation to both Houses. Reporting creates a way to scrutinise the powers; it does not make every confidential instruction immediately public.

The powers are not a general licence to listen in, either. The minister cannot order interception under subsection 15.2(2) or require encrypted private communications to be decoded. The Privacy Act remains intact. These are limits written into the law, not proof that every privacy dispute has been settled.

The 72-hour number belongs to another set of rules

The same legislation also enacted the Critical Cyber Systems Protection Act, or CCSPA. This is about ongoing protection of critical systems: security programmes, supply-chain risks and incident reporting. It covers designated classes of operators in vital sectors, including telecoms, rather than automatically imposing every duty on every telecom company.

The official consolidation current to 30 September 2026 marks CCSPA as not yet in force. That is a dated observation; it does not establish that no later instrument appeared in October.

Starting the law, deciding which operators it covers and filling in its rules are separate steps. The distinction matters most when a headline turns a number into an apparent deadline. Section 17 leaves the incident-reporting period to regulations, with a ceiling of 72 hours. It does not say that every carrier acquired an identical 72-hour duty on assent day. Reports go to the Communications Security Establishment, followed immediately by notice and a copy to the appropriate regulator.

One law can therefore confront a carrier with quite different questions: could it be told to change its equipment, is it covered by continuing security duties, and what would it have to report? A date on a bill cannot answer all three. Neither can it tell us that equipment has actually been removed. For that, the story has to move from the power to the evidence of its use.

Correction, 21 October 2026: This version corrects the reference to Canada's Parliament, distinguishes legal powers from issued orders and clarifies reporting triggers. The CCSPA commencement statement is expressly tied to the consolidation current to 30 September 2026.