Signal, DuckDuckGo warn they may exit Canada over encryption bill
Tech companies are pushing back against Bill C-22, which would require them to build or maintain surveillance capabilities, potentially weakening encryption protections.
A growing chorus of tech companies is warning they could pull services from Canada if the federal government's lawful access legislation passes.
Bill C-22 would allow regulations requiring service providers to retain certain metadata for up to a year and develop capabilities for police and the Canadian Security Intelligence Service to access that information for investigations.
The encrypted messaging app Signal is among the most prominent to sound the alarm. "In its current form, Bill C-22 would convert the everyday tools Canadians rely on into a sprawling, insecure surveillance apparatus," Signal's vice-president of strategy, Udbhav Tiwari, told the House of Commons public safety committee Tuesday. "If we are ever forced to choose between betraying the people who rely on us and leaving a market, we will leave."
Apple and Google have raised similar concerns. Companies say the bill as written could require them to build or maintain capabilities that break or weaken encryption — effectively creating backdoors into their products. Such backdoors could then be exploited by cybercriminals, exposing retained metadata to wide-scale breaches.
VPN services are also revolting. NordVPN said it would refuse to compromise privacy and encryption protections and would "consider all viable options, including limiting or, if necessary, removing our presence from Canadian jurisdiction." Windscribe, a Canadian-based VPN service, signaled it wouldn't be far behind.
Michael Geist, a University of Ottawa professor and Canada research chair in internet and e-commerce law, said the concern cuts deeper than backdoors. "The government through this legislation seeks to insert itself into the networks and devices of various providers," he told Global News. Providers that comply could face major redesign costs and increased metadata storage expenses, potentially raising prices for customers.
The bill as written would introduce mandatory requirements for certain "core" providers — likely large telecommunications and satellite companies — to maintain specific capabilities for law enforcement access. It would also allow the public safety minister to issue ministerial orders requiring any provider to develop a capability, even if they're not designated as core. Those orders would only require approval from the intelligence commissioner, not a judicial warrant, and providers would be prohibited from disclosing their existence.
For Canadian tech users, the fight is just beginning.