Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.
Comment Loader Save Story Save this story Comment Loader Save Story Save this story Welcome to Kernel Panic , a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here . Oh, Canada. The Great White North is the latest country to contemplate legislation that could essentially mandate backdoors and increase data retention in encrypted services. The proposed changes have prompted the Canadian anti-censorship company Psiphon VPN—which keeps millions of Iranians online during repressive internet shutdowns —to say it will leave the country if the bill passes. And Psiphon is not the only one. Encrypted messaging app Signal has said it would exit the Canadian market because the legislation would require unacceptable changes to its open source projects. Apple and Meta have criticized the bill, and DuckDuckGo and NordVPN say they would consider pulling their services, too. But as countries around the world contemplate similar legislation, even larger questions begin to emerge about which states or regions could differentiate themselves as being safe havens for privacy services if global hostility to encryption continues to rise. “There have always been some officials within certain agencies that tend to view technology as a crime scene in and of itself, and it becomes a myopic point of fixation where access is desired,” says Kate Robertson, a senior research associate at the University of Toronto’s Citizen Lab. “But that type of siloed thinking forgets that technology needs to be the secure operating platform for hospitals, for banks, for national security agencies, for police services themselves to protect victims who report private information to them.” In recent years, the UK and Australia have introduced sweeping surveillance reforms that can compel companies to break their encryption . Other encryption-threatening proposals have also emerged in the EU , France , India , Ireland , Spain , Sweden , Switzerland , and others. While not all measures have passed into law or been enacted, the hostility is clear. First proposed in 2025, and partially revised due to blistering criticism from tech companies and civil society, Canada’s C-22 bill can broadly place requirements on tech companies, including those outside of Canada, to introduce “technical capabilities” that allow data to be accessed for law enforcement purposes. Like many such bills, C-22 says that companies will not have to introduce a “systemic vulnerability” into their systems. But opponents have pointed out that any capability to access end-to-end encrypted data amounts to a backdoor that could be discovered and abused by anyone. And this risk is only heightened even more by the ease with which anyone can now use AI tools for reverse engineering and system mapping. “Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption,” members of the US House Judiciary and Foreign Affairs committee said in a May letter to Canadian officials. In addition to potential impacts on encryption, C-22 also includes provisions that could require companies to retain metadata about user activity, something that many privacy focused services (including VPN services from Psiphon and DuckDuckGo) intentionally avoid. As a result, these companies say, they would be forced to change their business models to collect data they do not need or want to collect about their users. And researchers say that such product changes would diminish user trust while increasing the potential for widespread surveillance. “If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it,” says Afsaneh Rigot, the founder of the De|Center, a research organization that aims to reduce the risk of technological harms. “There are contexts like Iran and other contexts globally, who all of this has a trickle effect on. It’s not going to stay in Canada because these types of laws always get copy pasted around the world.” As more countries contemplate such laws, developers focused on privacy and anti-censorship tools are increasingly casting around for safe jurisdictions to operate in. But this still doesn’t solve the problem of reaching users in all countries around the world and for now, there are no sure bets. “Changing your headquarters isn’t much of a plan B when the law follows your users, as C-22 would,” says Joseph Lorenzo-Hall, security portfolio lead at the Internet Society. “The strongest protection is holding as little user data as possible, but ‘we don’t have it’ is no defense if governments can force you to start collecting it. A safe haven needs more than favorable winds in strong encryption. It needs laws that let companies keep their privacy promises and defend them against foreign threats to confidentiality and integrity.” Spotted something we should include next week? Let us know at [email protected] . And stay safe out there.