Ottawa — Canada's Bill C-22 Could Force Encryption Backdoors

Canada's proposed surveillance legislation, first introduced in 2025 and since revised, would place new data-retention and access requirements on tech companies — including those based outside the country — and has drawn exit threats from several encrypted-service providers, according to WIRED.

What does the bill require?

The legislation, referred to in the reporting as Bill C-22, can impose obligations on companies operating in Canada, including firms headquartered elsewhere, WIRED reports. The outlet describes the measure as one that could "essentially mandate backdoors and increase data retention in encrypted services," placing it alongside a wave of similar proposals that critics say would compel companies to weaken or bypass end-to-end encryption rather than simply hand over data they already hold.

Which companies say they will leave, and why?

Psiphon VPN, a Canadian anti-censorship company that WIRED says "keeps millions of Iranians online during repressive internet shutdowns," has said it will leave Canada if the bill passes. Signal has said it would exit the Canadian market because the legislation would require what WIRED describes as "unacceptable changes to its open source projects." Apple and Meta have criticized the bill, and DuckDuckGo and NordVPN say they would consider pulling their services as well, according to the report.

How does this compare to other countries' proposals?

Canada is not acting in isolation. WIRED notes that the UK and Australia have already introduced "sweeping surveillance reforms that can compel companies to break their encryption," and that comparable proposals have surfaced in the EU, France, India, Ireland, Spain, Sweden, and Switzerland. Not all of those measures have become law, but the outlet says "the hostility is clear" across democracies that are expanding police and intelligence access to encrypted data.

Why do security experts oppose backdoor mandates?

Kate Robertson, a senior research associate at the University of Toronto's Citizen Lab, told WIRED that some officials treat technology itself as a crime scene. "There have always been some officials within certain agencies that tend to view technology as a crime scene in and of itself, and it becomes a myopic point of fixation where access is desired," Robertson said. She added that this view "forgets that technology needs to be the secure operating platform for hospitals, for banks, for national security agencies, for police services themselves to protect victims who report private information to them."

WIRED reports that cryptographers and security engineers have "consistently said" intentional flaws in encrypted products — the mechanism these bills would require — cannot be built safely, a position the outlet describes as a near-universal consensus among people who understand the underlying systems.

What happens next?

WIRED frames the broader question as whether any country or region will emerge as a safe haven for privacy-focused services if hostility to encryption keeps spreading. Canada's bill was already revised once after criticism from tech companies and civil-society groups, per the report, but the core access provisions remain contested as the legislation moves through further review. No final vote date is cited in the available reporting.

AlterEgo — A keyboard for character voices. Five free persona rewrites a day.