Telecom - Staff Letter addressed to the Distribution list
Ottawa, 1 October 2024
Our reference: 8000-C12-202203868
BY EMAIL
Distribution list
Subject: Disclosure of information designated as confidential in Xona Report
Dear recipients,
This letter addresses a request submitted by Vaxination Informatique on 14 August 2024 for disclosure of information designated as confidential by Rogers Communications Inc. (Rogers) in the report submitted by Xona Partners Inc. (Xona) on the Rogers’ outage of July 2022.
Background
On 4 July 2024, the Commission published the executive summary of the report completed by Xona (Xona report) on Rogers’ July 2022 outage.
On 5 July 2024 and 8 July 2024, the Commission received letters from PIAC and Vaxination Informatique, respectively, requesting publication of the full Xona report. The Commission responded to these letters on 10 July 2024 and initiated the process to identify and consider the disclosure of information filed in confidence in the Xona report.
On 31 July 2024, Rogers claimed confidentiality of certain information with justification and submitted a redacted version of the full report. The Commission published the redacted version and provided 14 days for interested persons to file any requests for disclosure.
The Commission received only one request for additional disclosure from Vaxination Informatique on 14 August 2024. Rogers provided their response to this request on 23 August 2024 and asked that the Commission approve the redacted version of the Xona report that they had submitted, and not to disclose the additional information requested by Vaxination Informatique, for reasons cited in their response.
General Principles
Requests for disclosure of information designated as confidential are considered in light of sections 38 and 39 of the Telecommunications Act (the Act), as well as sections 30 to 34 of the Canadian Radio-television and Telecommunications Commission Rules of Practice and Procedure (the Rules of Procedure).
Commission staff notes that the information in the Xona report for which Rogers claimed confidentiality was not submitted in the course of a proceeding. This information was provided by Rogers in confidence, in response to the requests for information sent to Rogers by the Commission staff and Xona.
Since the information subject to the requests for disclosure considered in this letter was not submitted to the Commission during a proceeding, the Commission’s power to disclose the information is governed by section 39(5) of the Act. Pursuant to this provision, disclosure may be required, after considering representations by interested parties, if it is determined that the information is relevant to the determination of a matter before the Commission and disclosure is in the public interest. In this case, the disclosure of information is not relevant to the determination of a matter before the Commission and public interest must be considered in relation to the direct harm that could result from disclosure of confidential information.
Vaxination Informatique Request for Disclosure of Information
Vaxination Informatique requested disclosure of the full Xona report including information specific to Rogers’ network segmentations, equipment, and vendors to better understand its network functions and process. It argued that such disclosure is required for a proper evaluation of Rogers’ network reliability and to allow customers to properly assess whether they can rely on a single network provider for their communications needs. Vaxination also argued that full disclosure was essential for an informed discussion on ensuring that the “7(b) render reliable” portion of Telecommunications Act Policy Objectives is achieved.
Vaxination Informatique stated that both 9-1-1 and public alerting are mandated public emergency services and releasing information to explain how these were affected by the outage would not hurt the company, instead it would assist in restoring confidence that the company understood what happened. Vaxination Informatique further stated that the Xona report likely has no financial data when it pertains to 9-1-1 and alerting therefore is no justification for Rogers to redact anything about these services.
Rogers Response
Rogers indicated that disclosure of the redacted information concerning Rogers’ systems design and network operations could be exploited by malicious actors who seek to disrupt Rogers’ systems and harm the telecommunications infrastructure that Canadians depend on.
Rogers also indicated that the information concerning their customers, suppliers, deployment plans, network design, operations and detailed statistics relating to 9-1-1 calling and emergency alerts during an outage is commercially sensitive. Disclosure of this information could cause specific direct harm to Rogers, their customers, suppliers and the public in general. Rogers further stated that if this information was disclosed it could reasonably be expected to:
- result in material financial gains or losses to consumers, businesses, Rogers, and other network operators and suppliers;
- prejudice the competitive position of Rogers;
- affect contractual obligations or other negotiations of Rogers, their suppliers and their customers; and
- compromise the reliability and resilience of Rogers’ networks
Commission Staff Determinations
Commission staff considers the information for which Rogers has claimed confidentiality in Xona report, falls within the categories identified in section 39(1) of the Act and can therefore be deemed confidential.
With respect to the issue of direct harm, Commission staff is of the view that disclosure of information contained in the Xona report pertaining to Rogers’ network design, equipment, assets, as well as security processes would likely cause direct harm to Rogers and its customers, in that it would provide valuable information that could be used by malicious actors to attack Rogers’ networks and systems.
For information pertaining to 9-1-1 and emergency alerting, Commission staff is of the view that bad actors could potentially use the specific 9-1-1 calling statistics, third-party information, and network information to interfere with 9-1-1 calling and emergency alerting services. Regarding detailed statistics of 9-1-1 calls and emergency alerts, it is Commission staff’s view that this level of detail would not advance the public’s understanding of the steps and measures Rogers has taken to ensure the reliability of 9-1-1 dialing and emergency services. The Commission’s consistent practice has been to maintain the confidentiality of this detailed type of information for all carriers. Releasing such information only in relation to Rogers would reasonably prejudice Rogers’ competitive position.
Commission staff considers that the specific direct harm that could result from public disclosure significantly outweighs the public interest in disclosure of this information. Specifically, the direct harm in this instance would be incurred not only by Rogers whose network could be damaged or otherwise compromised by bad actors seeking unauthorized access, but potentially all the customers that rely on Rogers’ network and services.
The Xona report was commissioned to understand the exact cause or causes of the July 2022 outage and whether Rogers had taken appropriate measures to address any such cause and avoid similar large-scale outages in the future. The scope of Xona's work warranted that it includes in its report detailed information specific to Rogers' network architecture and operational procedures which are consistently treated in a confidential manner by network operators.
Appreciating the public interest in disclosing the conclusions of the report in an expeditious manner, the Commission published a comprehensive summary of the report for which Rogers waived confidentiality. This summary provides Canadians with detailed information about what happened on 8 July 2022 and the measures Rogers has initiated to improve its operations and the resiliency of its networks. Additionally, Rogers has made further disclosure of substantive information in the Xona report.
Accordingly, Commission staff considers that no further disclosure of information is required.
Commission’s actions to improve resiliency and reliability of telecommunications services
The safety and security of Canadians is a top priority of the Commission. In recent years, telecommunications networks have experienced large scale outages causing major disruptions in the lives of Canadians. In order to improve resiliency and reliability of telecommunication networks and services of all TSPs, the Commission has approved a multistage approach which consists of multiple notices of consultations (NoC).
In the first stage, the Commission initiated a proceeding about setting requirements for service providers to report on major service outages to the Commission and other relevant government organizations. As its next step, the Commission will initiate public proceedings to address network reliability and resiliency in broader terms which will include consideration of issues related to a number of matters, including accessibility of telecommunications services, emergency services, consumer communication and various other aspect identified at paragraph 10 of Telecom Notice of Consultation CRTC 2023-39.
Given the comprehensive scope of existing and announced proceedings relating to the resiliency and reliability of telecommunications networks of all TSPs, staff considers that these proceedings will provide Canadians opportunities to intervene and comment on the matters which will greatly assist the Commission in discharging its role and ensuring that appropriate measures are adopted.
Yours sincerely
Aysha Omar
A/Director, Broadband and Network Engineering
Telecommunications Sector
Distribution List:
Howard Slawner, Rogers Communications Canada Inc., Howard.Slawner@rci.rogers.com
Jean-Francois Mezei, Vaxination Informatique, jfmezei@vaxination.ca
- Date modified: