From WIRED · Matt Burgess · · 1m 50s
Encryption faces pressure from governments worldwide
Canada's proposed bill would mandate backdoors in encrypted services, prompting major tech companies to threaten withdrawal and raising questions about safe havens for privacy tools.
In brief
Canada's proposed bill would mandate backdoors in encrypted services, prompting major tech companies to threaten withdrawal and raising questions about safe havens for privacy tools. Canada's C-22 bill would require encrypted services to build backdoors and retain user data, prompting Signal, Apple, Meta and others to…
Canada targets encrypted services
Canada's proposed C-22 bill would require tech companies to introduce technical capabilities allowing law enforcement data access. Signal, Apple, Meta, DuckDuckGo and NordVPN have threatened to leave the country if it passes.
Psiphon warns of Iranian impact
Psiphon VPN, which keeps millions of Iranians online during repressive internet shutdowns, says it will leave Canada if the bill passes. The company opposes unacceptable changes to its open source projects.
Global wave of encryption threats
The UK and Australia have introduced sweeping surveillance reforms that can compel companies to break encryption. Similar proposals have emerged in the EU, France, India, Ireland, Spain, Sweden and Switzerland.
What C-22 would require
First proposed in twenty twenty-five and partially revised, C-22 can place requirements on tech companies to introduce technical capabilities for law enforcement access.
“Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption.”
Metadata retention changes business
C-22 includes provisions requiring companies to retain metadata about user activity. Privacy-focused services like Psiphon and DuckDuckGo intentionally avoid this, saying they would be forced to change their business models and collect data they do…
Surveillance spreads globally
Afsaneh Rigot, founder of the De|Center, warns that requiring metadata retention creates surveillance infrastructure in tools designed to protect privacy. Such laws get copied around the world, affecting contexts like Iran and others globally.
“If you are asking and requiring for this infrastructural change, that they retain metadata by default, it is creating a surveillance capability within a tool that didn't have it.”
No safe haven yet
As countries contemplate such laws, privacy developers seek safe jurisdictions to operate in.But Joseph Lorenzo-Hall of the Internet Society says changing headquarters is not a plan when the law follows users.
“Changing your headquarters isn't much of a plan B when the law follows your users, as C-22 would.”
The essence
Canada's C-22 bill would require encrypted services to build backdoors and retain user data, prompting Signal, Apple, Meta and others to threaten leaving the country as similar laws spread globally.
