Canada Considers Legislation Requiring Encrypted Services to Provide Backdoors

Canada is set to become the latest country to consider legislation that would effectively require encrypted services to provide backdoors and increase data retention. This move has sparked concerns among tech companies, with some indicating they may be forced to leave the country if the bill passes.

Psiphon VPN, a Canadian company that provides internet access to millions of users in Iran during periods of internet shutdowns, has stated it will exit Canada if the legislation is passed. The encrypted messaging app Signal also announced it would withdraw from the Canadian market, citing unacceptable changes to its open-source projects as a result of the proposed law.

Apple and Meta have expressed criticism of the bill, while other companies such as DuckDuckGo and NordVPN are considering pulling their services from Canada if the legislation is enacted. These measures could impact millions of users who rely on these services for secure communication.

The Canadian government's proposed changes to encryption laws come amidst a broader global trend where countries are increasingly seeking to limit or restrict access to encrypted data. This has raised questions about which regions can serve as safe havens for companies that prioritize user privacy in the face of rising hostility to encryption.

The trend of democratic countries proposing changes to their surveillance laws has been alarming, giving law enforcement and intelligence agencies greater powers to access citizens' information. These legislative proposals often include measures that go beyond existing digital surveillance capabilities, such as mandating additional logging or intentionally flawed encryption.

Cryptographers and security engineers have consistently warned against building backdoors into encrypted products, arguing it's not possible to do so safely. Despite this, policymakers continue to propose these ideas, seemingly expecting a breakthrough that will make them feasible. This has led some experts to view the debate as myopic, with access to data being prioritized over other considerations.

The issue is complex and nuanced, with different agencies having varying views on technology and its role in law enforcement. Some officials see technology as a crime scene, which can lead to an overemphasis on accessing encrypted data. This fixation on access has led to repeated attempts to expand the powers of law enforcement and intelligence agencies.

Experts like Kate Robertson, a senior research associate at the University of Toronto's Citizen Lab, have highlighted the challenges posed by these proposals. According to Robertson, some officials within certain agencies tend to view technology as a means to an end, rather than a tool that needs to be used carefully.

The trend of governments pushing for encryption-compromising measures continues to spread globally. In addition to the UK and Australia's recent surveillance reforms, other countries are also considering proposals that could erode online security. These include several EU nations, as well as France, India, Ireland, Spain, Sweden, Switzerland, and others.

While not all of these measures have been enacted into law, it is clear that governments are increasingly hostile to encryption. This hostility is evident in various proposals, including one from Canada's C-22 bill. First introduced in 2025, the bill has undergone revisions due to criticism from tech companies and civil society groups.

The revised Canadian bill would require tech companies to introduce "technical capabilities that allow law enforcement access to encrypted data. Companies would not be forced to create a systemic vulnerability," but opponents argue that any capability for accessing end-to-end encryption amounts to a backdoor. This could potentially be exploited by malicious actors.

The risk of such vulnerabilities being discovered and abused is compounded by the growing ease with which anyone can use AI tools for reverse engineering and system mapping.

The proposed C-22 bill in Canada has raised concerns among companies that prioritize user privacy. The legislation includes provisions that could require businesses to retain metadata about their users' activities, which many services intentionally avoid collecting. This would force some companies to change their business models and collect data they may not need or want.

Privacy-focused services like VPN providers from Psiphon and DuckDuckGo are particularly affected by this proposal. They argue that retaining user metadata would diminish trust among customers while increasing the potential for widespread surveillance. Researchers emphasize that such changes could have far-reaching consequences, including enabling governments to monitor users' activities more easily.

The impact of C-22 on encryption is also a pressing concern. Members of the US House Judiciary and Foreign Affairs committee have warned Canadian officials about the risks of introducing vulnerabilities or backdoors into encrypted systems. This could compromise user security and make it easier for malicious actors to intercept sensitive information.

Experts like Afsaneh Rigot, founder of the De|Center research organization, highlight the potential consequences of C-22's metadata retention provisions. She notes that such changes would effectively create a surveillance capability within tools that were previously designed without this feature. This could have ripple effects globally, particularly in contexts where governments are known to restrict online freedoms.

As countries around the world consider laws that would require tech companies to provide backdoors for law enforcement, developers of privacy and anti-censorship tools are searching for jurisdictions where they can operate without fear of prosecution. However, even if these developers find a safe haven, it's unclear how they will reach users in all countries.

The problem is exacerbated by the fact that many governments are willing to force tech companies to comply with their demands, regardless of where the company is headquartered. This has left developers scrambling for solutions, with some arguing that the strongest protection against government overreach is holding as little user data as possible. However, this approach may not be enough if governments can force companies to start collecting more data.

The search for a safe haven continues, but it's becoming increasingly clear that no single jurisdiction offers complete protection from government demands. Ultimately, tech companies will need to adapt and innovate in order to protect their users' privacy and security in the face of these growing challenges.