Summary

  • CRTC Decision 2026-140 moves the Canadian carrier framework beyond approved blocklists to any method consistent with necessity, accuracy and consumer privacy.
  • The carrier, rather than a public CRTC vendor registry, must show that a third-party provider has the relevant expertise and no conflict that could compromise impartial operation.
  • Public disclosures and confidential annual filings divide what customers can see from what the Commission can inspect; the decision itself does not prove which suppliers or methods are in use.

A carrier’s security purchase is no longer just a choice of threat feed. A port filter, source-address check or rule triggered by an unusual traffic volume can sit between a customer and the wider Internet. That makes the vendor behind the control part of the operating risk. Canada’s regulator has widened the methods carriers may use, but it has not taken over the work of deciding whether a supplier is suitable.

The legal starting point is unusual but explicit. Section 36 of the Telecommunications Act generally bars a Canadian carrier from controlling the content or influencing the meaning or purpose of public telecommunications unless the Canadian Radio-television and Telecommunications Commission (CRTC) approves it. The Commission’s 2022 decision treated network-level botnet blocking as an exercise of that authority. It set principles for necessity, accuracy, transparency, customer privacy and accountability, then asked the industry’s technical committee to work through implementation.

The next step was narrower. In 2025-142, the CRTC authorized network-level blocking through qualifying in-house or third-party blocklists. Blocking would operate by default for customers of a participating carrier; a customer could not opt in or out. A separate 2025 consultation then asked about port blocking, forged source addresses, file signatures, traffic-volume anomalies, deep packet inspection, data retention and reporting. The Commission was trying to fit techniques that carriers already said they used inside a common authorization framework.

Decision 2026-140, effective 18 June 2026, answers that question with method neutrality. Carriers may use any blocking method that meets the framework’s principles. The decision names port blocking, forged-source-address blocking and volume-anomaly rules among techniques in use. It does not say that every carrier uses each technique, nor does it prescribe one product or threat feed.

That wider choice creates a procurement responsibility. Section 2.3 of the revised framework says that a third-party provider must have the necessary technical expertise and must not have potential conflicts that could compromise unbiased operation in Canadians’ interests. The Commission explicitly points to ownership and geopolitical context as examples. Section 2.2 puts the burden on the carrier to demonstrate compliance. This is not a public list of vendors approved in advance by the CRTC.

It is a duty on the carrier to know who supplies the tools, what expertise supports them, and whether the provider’s interests or ownership could distort the service.

The distinction matters because “cybersecurity vendor” is not a single technical category. A supplier may deliver a feed of indicators, software that evaluates traffic patterns, a device that enforces a rule, or an outsourced monitoring service. The CRTC’s framework reaches the provider supplying systems, equipment or software used to implement blocking. Carriers therefore have to map the chain that turns a threat signal into a decision at the network edge. A contract naming a product is not, by itself, evidence that its indicators are accurate or that the vendor has no relevant conflict.

The framework creates two disclosure layers. A carrier’s public website must describe the type and scope of its blocking, the methods in general terms, whether it uses third-party providers and whether any are located outside Canada. It must also explain how customers can raise false-positive or over-blocking concerns. The Commission warns against publishing details that would help attackers bypass defenses. The public therefore gets a view of the control surface, not the rule set or each supplier’s operational playbook.

The regulator receives more. Each carrier must file a confidential annual report identifying the methods used and third-party providers or products relied on, the number of indicators of compromise blocked, complaints about false positives or over-blocking, and a detailed rationale for compliance. Reports are due within 30 calendar days after each reporting period. The Commission may publish certain counts or use confidential filings to create industry summaries. Carriers must also review their systems periodically.

The framework limits deep packet inspection to exceptional circumstances and, when used, to packet headers rather than message contents; it also says carriers must not prevent customers from using legitimate VPN services or alternative DNS resolvers to circumvent blocking.

That arrangement leaves a real tension. Customers need enough information to understand what a carrier is doing. Security teams do not want to publish thresholds or technical detail that make evasion easier. Suppliers may sit outside Canada, while the carrier retains the obligation to explain why the supplier belongs in the chain. A confidentiality boundary can protect defensive information, but it also makes the quality of the regulator’s review more important.

Commissioner Bram Abramson’s dissent offers a useful counterweight. He agreed that the framework should cover a wider range of cybersecurity methods, but argued that the adopted reporting and complaint systems would make some errors hard to find. His proposed reports included the lifecycle of vendors and measures and the disposition of complaints. Those proposals are not binding requirements. They show the unresolved question: whether the Commission can evaluate the carrier’s evidence over time, rather than simply receive a supplier name and a compliance explanation once a year.

For carriers, the decision raises the value of supplier due diligence, not because it names a problematic vendor, but because the carrier remains the accountable party when the vendor’s software or data drives a blocking action. Procurement should connect technical qualification to conflict review, data handling, change notification, incident escalation and a workable exit path. Smaller operators may find it harder to document this chain, especially if they depend on an upstream provider or shared security service; that is an operating implication, not a measured cost in the CRTC record.

For vendors, market access now depends on more than threat coverage. Carriers must be able to explain the supplier’s expertise, ownership and role, and identify the systems or products in confidential reports. That can reward providers willing to support audits and disclose enough for a carrier to stand behind their work. It can also raise compliance costs and favor vendors that already have mature assurance material. The decision does not show which effect will dominate.

The first reporting period begins when the revised framework took effect and ends on 31 December 2026. The first reports should give the Commission an initial record of methods, providers and complaint counts, but they will not automatically establish detection accuracy or the rate of legitimate traffic blocked. The number of complaints is an outcome that depends partly on whether customers can recognize the block and find the reporting channel. The system’s proof burden remains on carriers, but the public cannot yet see the evidence that would show how consistently they meet it.

The CRTC’s choice is therefore neither “let vendors decide” nor “the regulator approves every tool.” It is a delegated model: carriers choose methods and providers, then carry the obligation to justify that choice under shared principles. Its credibility will depend on whether supplier diligence becomes a repeatable control—reviewed when vendors, ownership, methods or threat feeds change—and whether the Commission turns confidential filings into useful oversight. The expansion is now in force. The vendor chain, and the evidence supporting it, will be the test.

Sources