A Familiar Fight Returns to Canada
Canada has become the latest front in a debate that security researchers have been having for decades. Proposed legislation known as C-22 would allow authorities to compel technology companies, including those based abroad, to build “technical capabilities” that let law enforcement access data. Companies would be shielded from being required to introduce a “systemic vulnerability,” but critics argue that any mechanism for reading end-to-end encrypted messages is, by definition, a backdoor that others could find and exploit.
The reaction has been swift. Psiphon, the anti-censorship VPN that helps millions of people in places like Iran get online during shutdowns, has said it will leave Canada if the bill passes. Signal has made a similar threat, arguing the changes would require unacceptable alterations to its open source code. Apple, Meta, DuckDuckGo, and NordVPN have all voiced objections or suggested they could reconsider their presence in the country.
Why Metadata Rules Matter as Much as Backdoors
Much of the attention has centered on decryption, but C-22 also contains provisions that could require companies to retain metadata about user activity. Privacy-focused services often deliberately avoid collecting that information. Being forced to start doing so would mean rebuilding business models around data that was never meant to exist. Researchers warn this can quietly create surveillance capacity inside tools that were designed without it.
Afsaneh Rigot of the De|Center notes that the consequences would not stay within Canadian borders. Laws of this kind tend to be copied and adapted elsewhere, and the people most affected are often users in countries with already fragile digital rights. The UK and Australia have passed sweeping surveillance measures that can compel companies to weaken encryption, and similar proposals have surfaced in the EU, France, India, Spain, Sweden, and Switzerland. While not all have become law, the direction of travel is hard to miss.
The Limits of Running for Safe Harbor
One intuitive response for privacy developers is to relocate to a friendlier jurisdiction. Joseph Lorenzo-Hall of the Internet Society points out that this is a weak plan when the law follows the user rather than the company’s headquarters. The most durable defense is collecting as little data as possible, since a company cannot hand over information it never stored. A genuine safe haven, he argues, needs legal protections that let providers keep their promises and resist foreign pressure on confidentiality and integrity.
For ordinary people, the stakes are practical. Choosing a messaging app, VPN, or search engine increasingly involves questions that were once niche: where is the company legally bound, what does it log by default, and could it be forced to change how its product works? For consumers and businesses evaluating security tools, these factors are becoming part of the purchase decision itself. Shoppers comparing privacy products are paying closer attention to jurisdiction, logging policies, and whether a provider has a credible plan if laws shift. That growing scrutiny will shape which tools gain adoption and which quietly lose ground as governments keep testing the limits of encryption.
