Canada is facing major backlash over proposed legislation that could force tech companies to create backdoors into encrypted services and increase data retention, sparking fears for global privacy.
The proposed changes, outlined in bill C-22, have prompted significant concern from privacy-focused companies. Psiphon VPN, a crucial tool for millions in Iran, has stated it would leave Canada if the bill passes. Encrypted messaging app Signal has also declared it would exit the Canadian market, citing unacceptable risks to its open-source projects. Apple, Meta, DuckDuckGo, and NordVPN have all voiced criticism and are considering pulling their services.
This situation raises broader questions about potential safe havens for privacy services as global hostility towards encryption appears to be rising. Many democratic nations are considering similar legislation, aiming to grant law enforcement and intelligence agencies greater access to user information, despite existing broad surveillance powers.
Critics argue that mandating intentional flaws or backdoors in encrypted products, as these proposals often do, is fundamentally unsafe. Cryptographers and security engineers have consistently warned against this for decades, yet policymakers continue to pursue the idea. As Kate Robertson from the University of Toronto's Citizen Lab noted, some officials view technology narrowly as a "crime scene," overlooking its essential role in securing critical infrastructure like hospitals and banks.
While Canada's C-22 bill claims companies won't have to introduce "systemic vulnerabilities," opponents argue that any capability to access end-to-end encrypted data effectively becomes a backdoor. This risk is amplified by the ease with which AI tools can now be used for reverse engineering and system mapping, according to a letter from US House committees to Canadian officials.
Beyond encryption, C-22 could also compel companies to retain user metadata, a practice many privacy services intentionally avoid. This would force a shift in business models and, researchers warn, diminish user trust while enabling wider surveillance. Afsaneh Rigot of the De|Center highlighted that such infrastructural changes create surveillance capabilities and have a global trickle-down effect, as these types of laws are often copied worldwide.
As more countries consider similar laws, privacy developers are seeking secure jurisdictions. However, simply changing headquarters may not be enough if laws follow users, as C-22 could. Joseph Lorenzo-Hall of the Internet Society emphasized that the strongest protection remains holding minimal user data, but even that is insufficient if governments can compel collection. True safe havens require not only strong encryption but also laws that protect companies' privacy promises and defend them against external threats.
