Canada's Bill C-22 would mandate encryption access and metadata retention, prompting Signal and Psiphon to threaten to exit
Canada's proposed C-22 bill, first put forward in 2025 and since partly revised, would require tech companies, including foreign ones, to introduce "technical capabilities" for law enforcement data access. It would also require retention of user metadata. Signal has said it would exit the Canadian market, and Psiphon VPN says it will leave if the bill passes. DuckDuckGo and NordVPN say they would consider pulling their services, and Apple and Meta have criticized the bill. Researchers and civil society argue that any capability to access end-to-end encrypted data amounts to a backdoor that others could discover and abuse, a risk heightened by AI-assisted reverse engineering. The article places C-22 within a wider trend of encryption-threatening proposals, including laws already passed in the UK and Australia and proposals in the EU, France, India, Ireland, Spain, Sweden and Switzerland.
Technical Details
- C-22 states that companies need not introduce a "systemic vulnerability", but critics say this does not remove the backdoor risk.
- The bill can apply to companies outside Canada.
- It could require default metadata retention, which privacy-focused services such as Psiphon and DuckDuckGo VPN deliberately avoid. Researchers warn this would create a surveillance capability in tools that did not have one.
- Members of the US House Judiciary and Foreign Affairs committees warned in a May letter that companies could be asked to build backdoors or weaken encryption.
Remediation
No technical remediation applies. The article quotes the Internet Society's Joseph Lorenzo-Hall saying the strongest protection is holding as little user data as possible, but that this is no defense if governments can compel collection. Relocating headquarters is described as an inadequate plan B because the law follows the users.
Linha do tempo
-
Canada's Bill C-22 would mandate encryption access and metadata retention, prompting Signal and Psiphon to threaten to exit
ler a análise desta fonte ocultar
Canada's proposed C-22 bill, first put forward in 2025 and since partly revised, would require tech companies, including foreign ones, to introduce "technical capabilities" for law enforcement data access. It would also require retention of user metadata. Signal has said it would exit the Canadian market, and Psiphon VPN says it will leave if the bill passes. DuckDuckGo and NordVPN say they would consider pulling their services, and Apple and Meta have criticized the bill. Researchers and civil society argue that any capability to access end-to-end encrypted data amounts to a backdoor that others could discover and abuse, a risk heightened by AI-assisted reverse engineering. The article places C-22 within a wider trend of encryption-threatening proposals, including laws already passed in the UK and Australia and proposals in the EU, France, India, Ireland, Spain, Sweden and Switzerland.
Technical Details
- C-22 states that companies need not introduce a "systemic vulnerability", but critics say this does not remove the backdoor risk.
- The bill can apply to companies outside Canada.
- It could require default metadata retention, which privacy-focused services such as Psiphon and DuckDuckGo VPN deliberately avoid. Researchers warn this would create a surveillance capability in tools that did not have one.
- Members of the US House Judiciary and Foreign Affairs committees warned in a May letter that companies could be asked to build backdoors or weaken encryption.
Remediation
No technical remediation applies. The article quotes the Internet Society's Joseph Lorenzo-Hall saying the strongest protection is holding as little user data as possible, but that this is no defense if governments can compel collection. Relocating headquarters is described as an inadequate plan B because the law follows the users.