Canada is moving forward with legislation that could fundamentally alter how digital services operate within its borders, triggering immediate threats of withdrawal from major technology firms. The proposed C-22 bill, first introduced in 2025 and recently revised following intense scrutiny, would require companies to build technical capabilities allowing law enforcement access to encrypted data. This mandate has drawn sharp criticism from privacy advocates and industry leaders who argue the measures effectively force the creation of security vulnerabilities.
Psiphon and Signal Threaten Withdrawal
The most immediate reaction has come from Psiphon, a Canadian anti-censorship company that provides internet access to millions of users in Iran during government-imposed shutdowns. Psiphon announced it will leave Canada if the bill becomes law. The company stated that the legislation would require unacceptable changes to its open-source projects, undermining its core mission of providing uncensored access to information.
Signal, the widely used encrypted messaging application, issued a similar warning. The company indicated it would exit the Canadian market because the proposed changes would force it to alter its open-source code in ways that compromise user security. Apple and Meta have also publicly criticized the bill, while other major services like DuckDuckGo and NordVPN have stated they would consider pulling their operations from the country.
These reactions highlight a growing tension between government surveillance goals and the technical realities of modern encryption. The C-22 bill suggests that companies would not need to introduce a systemic vulnerability into their systems. However, opponents argue that any capability to access end-to-end encrypted data functions as a backdoor. Security experts note that such backdoors can be discovered and exploited by malicious actors, a risk that is amplified by the increasing accessibility of artificial intelligence tools for reverse engineering.
Metadata Retention and Global Impact
Beyond encryption, the legislation includes provisions that could compel companies to retain metadata about user activity. Many privacy-focused services intentionally avoid collecting this data to protect their users. Psiphon and DuckDuckGo, for example, have built their business models around minimizing data collection. The requirement to retain metadata would force these companies to change their operations, potentially diminishing user trust and creating new avenues for surveillance.
Afsaneh Rigot, founder of the research organization De|Center, warned that these changes create surveillance capabilities within tools that previously lacked them. She emphasized that the impact would not be confined to Canada. Laws of this nature often serve as templates for other nations, creating a trickle effect that undermines privacy protections globally. Rigot noted that contexts like Iran are particularly vulnerable to this spread of surveillance legislation.
The push for expanded surveillance powers is not unique to Canada. The United Kingdom and Australia have already introduced sweeping reforms that can compel companies to break encryption. Similar proposals have emerged in the European Union, France, India, Ireland, Spain, Sweden, and Switzerland. While not all measures have passed into law, the trend toward increased government access to private data is clear across democratic nations.
Search for Safe Havens
As hostility to encryption grows, developers of privacy and anti-censorship tools are searching for jurisdictions that offer stronger protections. However, experts argue that simply changing headquarters is not a viable solution. Joseph Lorenzo-Hall, security portfolio lead at the Internet Society, pointed out that laws like C-22 follow users, not just companies. He stated that the strongest protection remains holding as little user data as possible, but this defense is ineffective if governments can force companies to start collecting data.
Lorenzo-Hall argued that a true safe haven requires more than favorable political winds. It needs laws that allow companies to keep their privacy promises and defend them against foreign threats to confidentiality. The US House Judiciary and Foreign Affairs committees previously wrote to Canadian officials in May, warning that the bill could ask companies to weaken encryption or bypass security measures.
The debate over C-22 underscores a broader conflict between law enforcement demands for access and the technical necessity of secure digital infrastructure. Kate Robertson, a senior research associate at the University of Toronto’s Citizen Lab, observed that some officials view technology primarily as a crime scene. She noted that this perspective often overlooks the fact that technology serves as the secure operating platform for hospitals, banks, and national security agencies themselves.
As the Canadian government continues to refine the bill, the tech industry remains on high alert. The potential exodus of key privacy-focused companies could significantly impact Canada’s digital landscape and its reputation as a hub for internet freedom advocacy.
Source: Wired
