Canadian ISPs Can Now Block Botnet Traffic
Matthew Leo · Published July 28, 2026 · Canada Tech
Canadian Internet providers now have broader permission to block malicious traffic before it reaches customers—but that permission is not a blank cheque to quietly filter the Internet.
On June 17, 2026, the CRTC approved a revised framework for network-level cybersecurity blocking. It took effect the following day.
The decision allows participating carriers to use methods such as blocklists, port blocking, detection of forged addresses and traffic-anomaly analysis, provided the methods comply with principles covering necessity, accuracy, privacy and transparency.
It permits these measures. It does not require every provider to use every method, and it does not guarantee that every malicious connection will be stopped.
What is a botnet?
A botnet is a collection of computers, phones, routers or other devices infected with malware and remotely controlled without their owners’ knowledge.
Attackers can use botnets to distribute spam, steal information, spread malware or overwhelm online services with traffic.
Network-level blocking attempts to interrupt the communications that allow infected devices and malicious infrastructure to work together. Instead of relying entirely on security software installed on each customer’s device, the carrier can stop selected traffic within its network.
What carriers are allowed to block
The revised framework is broader than an earlier model centred mainly on blocklists. It lets carriers choose different tools as threats change.
- Blocklists: Lists of addresses or other indicators associated with malicious activity.
- Port blocking: Restricting traffic through communication ports commonly exploited in attacks.
- Forged-address blocking: Rejecting traffic that disguises where it came from.
- Volume-anomaly blocking: Responding to unusual traffic patterns associated with attacks.
The CRTC said a narrow list of approved techniques could become ineffective as attackers change their behaviour. Carriers also argued that some third-party security vendors would not disclose enough technical information to satisfy the former framework.
Flexibility makes operational sense. It also increases the importance of oversight because customers cannot easily see which rules caused a connection to fail.
The framework’s main safeguards
| Safeguard | What the carrier must do |
|---|---|
| Necessity | Use blocking for cybersecurity purposes, including botnets, malware and phishing. |
| Accuracy | Minimize false positives and avoid unnecessary effects on legitimate services. |
| Complaint handling | Receive, validate and resolve blocking complaints within five business days. |
| Public disclosure | Explain the general type and scope of blocking on the provider’s website. |
| Regulatory reporting | Report methods, blocked indicators, complaints and compliance information to the CRTC. |
Providers must also disclose whether they use third-party services, including whether those providers are outside Canada, and give customers a route for reporting suspected over-blocking.
What happens when a legitimate site is blocked?
A false positive occurs when a security system mistakenly treats legitimate traffic as malicious.
Under the framework, a carrier must maintain a complaint process and resolve a complaint within five business days. Its investigation may involve updating a blocking rule, working with a third-party vendor or concluding that the failure was unrelated to network blocking.
The practical difficulty is diagnosis. A blocked connection may resemble a broken website, a Domain Name System problem, an application error or an outage. Customers may not know that the carrier’s security system was involved.
If a normally reliable service suddenly stops working on home Internet but works through mobile data or another provider, customers should document:
- The exact website, application or destination affected.
- The date, time and error message.
- Whether the problem occurs on multiple devices.
- Whether changing networks makes the problem disappear.
- Whether the provider lists a cybersecurity-blocking complaint route.
That information cannot prove wrongful blocking, but it gives the provider something specific to investigate.
A commissioner warned that reporting is too thin
The decision includes a dissent arguing that the framework’s reporting requirements may not reveal whether the system is actually accurate.
A carrier could report many blocked indicators and few complaints while still using stale rules or creating errors customers never recognized as blocking. The dissent argued for more structured information about traffic volumes, rule changes, corrections and complaint outcomes.
That criticism is persuasive. A count of “things blocked” is not a security success rate without a useful denominator and information about mistakes.
The majority concluded that streamlined annual reports provide sufficient oversight without exposing defensive details that could help attackers.
This does not replace security on your devices
The CRTC explicitly warns that carrier blocking is not a replacement for updates, strong passwords, multi-factor authentication, firewalls and security software.
That is not regulator boilerplate. A network filter can interrupt known malicious traffic, but it cannot rescue every outdated router, reused password, deceptive download or compromised account.
The new framework is reasonable in principle: carriers need enough flexibility to react to fast-changing threats, and Canadians need a clear remedy when legitimate traffic is caught.
Its credibility will depend on the evidence the CRTC eventually publishes. Canadians should be able to see whether providers are stopping harmful activity without turning unexplained network failures into somebody else’s problem.
Tags: CRTC, botnets, cybersecurity, Canadian telecom, network blocking