No Warrant, No Reason, No Notice: Canada's New Disconnect Power - Foundation for Freedom Online Skip to content

News, Reports

No Warrant, No Reason, No Notice: Canada’s New Disconnect Power

by FFO Staff<br>June 29, 2026

SUMMARY<br>Canada’s new cyber-security law, Bill C-8 (An Act Respecting Cyber Security) , hands a cabinet minister the authority to order any telecom provider to cut off service to any named individual.<br>The power requires no warrant, no prior judicial review, and under a gag order that can bar the provider from saying why.<br>A new collection power lets the minister compel “any person” to surrender telecommunications data without a warrant.<br>During committee study, Parliament considered and then stripped out the strongest safeguards: prior judicial authorization for orders, court control over secrecy decisions, and mandatory breach notification.<br>A Canadian law sold as protection for critical infrastructure establishes a mechanism for the government to reach into Canada’s telecommunications networks, collect data on the people using them, and cut off individuals from internet access, with judicial involvement absent at every step.<br>The Minister of Industry can now prohibit an internet provider from offering “any service to any specified person,” or order service suspended for a fixed period. The order takes effect the moment the minister signs it, following consultation with the Minister of Public Safety. No court reviews it first.<br>The order can forbid disclosure of its own existence, meaning a Canadian can lose phone and internet access while the provider is legally barred from explaining why. And the Act specifies that no one is entitled to compensation for the financial damage such an order causes.<br>From C-26 to C-8<br>C-8 is the reincarnation of Bill C-26, which expired on the order paper when the previous Parliament was prorogued, then returned in substantially the same form. The provisions now in force were drafted, set aside, and reintroduced largely intact rather than rebuilt in response to the objections raised the first time around.<br>Structurally, the law runs on two tracks. The first rewrites the Telecommunications Act to install security as an explicit policy objective and to give the government direct authority over carriers. The second creates the Critical Cyber Systems Protection Act, which imposes mandatory cybersecurity obligations on designated operators in banking, energy, transportation, telecom, and the nuclear sector. Those operators must stand up formal cybersecurity programs within 90 days, manage supply-chain risk, and report incidents to the Communications Security Establishment within 72 hours, with violations carrying penalties as high as $15 million for a corporation. The telecom track is already operative; the infrastructure track phases in.<br>The Disconnect Power<br>The authority to cut off a named person is the bill’s sharpest edge. Because the Statutory Instruments Act does not apply, these orders bypass the normal regulatory publication path. The gag provision allows an order to prohibit disclosure of its existence. The compensation bar removes any financial remedy.<br>The government did add one narrow limit. It carved out individuals by barring orders that suspend an individual’s service unless the measure is necessary against a specified threat “of a technical nature.” That restriction applies only to the suspension power. The broader prohibition authority still reaches “any specified person,” with no equivalent guardrail.<br>Collection Without a Warrant<br>Section 15.4 of the amended Telecommunications Act lets the minister compel “any person” to produce information the minister deems necessary, again with no warrant and no prior judicial authorization.<br>The scope of what could be swept up is not in dispute. The Privacy Commissioner testified that the law could enable the collection and sharing of subscriber account details, communication data, websites visited, metadata, location, and financial information. The Intelligence Commissioner of Canada put the objection most plainly, calling the Canadian public the bill’s "glaring absentee" and noting that the information being collected is Canadians’ own personal information.<br>The Encryption Question<br>The order-making language is expansive enough to touch encryption itself. The minister may direct a provider to do anything, or refrain from doing anything, considered necessary to secure the telecommunications system. Critically, this wordingt does not exclude orders to install surveillance capabilities or degrade encryption standards.<br>Writing in The Globe and Mail, Citizen Lab’s Kate Robertson and Ron Deibert characterized these as secretive, encryption-breaking powers capable of threatening the online security of everyone in Canada, and warned the bill would let officials quietly order telecom companies to build backdoors into encrypted parts of the country’s networks.<br>Secrecy by Default<br>A recurring feature, not an incidental one, is...