Canada's encryption crackdown sparks global privacy exodus

Canada is about to learn what happens when governments try to force backdoors into encryption. The country’s proposed C-22 bill has triggered an unprecedented revolt from some of the world’s most important privacy and anti-censorship tools, with Signal, Psiphon VPN, and others threatening to exit the Canadian market entirely.

It’s a stark moment. Psiphon, the VPN service that keeps millions of Iranians connected during internet shutdowns, says it will leave if the bill passes. Signal, the encrypted messaging app trusted by journalists and activists globally, says the law would require unacceptable changes to its open source projects. Apple, Meta, DuckDuckGo, and NordVPN have all raised alarms.

The problem is straightforward: C-22 would require tech companies to introduce “technical capabilities” allowing law enforcement to access encrypted data. The bill claims companies won’t need to create “systemic vulnerabilities.” That’s meaningless. Any backdoor is a vulnerability, full stop. And in an age of AI-powered reverse engineering, those backdoors don’t stay secret.

The Real Cost of Forced Data Retention

But encryption backdoors aren’t the only threat in C-22. The bill also mandates metadata retention, forcing privacy-focused services to collect and store data about user activity. This is particularly damaging because these companies have built their entire business models around not collecting such data.

VPN services like Psiphon specifically operate under strict no-logging policies. Forcing them to retain metadata would fundamentally change what they are. It’s not just a technical adjustment; it’s a business model assassination. When you require surveillance infrastructure in a tool designed explicitly to prevent surveillance, you’ve destroyed the thing itself.

“If you are asking and requiring for this infrastructural change, it is creating a surveillance capability within a tool that didn’t have it,” says Afsaneh Rigot, founder of the De|Center. And here’s the scary part: what Canada does, others copy. These laws get replicated globally like some kind of authoritarian software update.

A Troubling Global Trend

Canada isn’t alone in this madness. The UK introduced sweeping surveillance reforms. Australia did the same. The EU, France, India, Ireland, Spain, and Sweden have all proposed encryption-threatening legislation. We’re watching tech policy become a race to the bottom.

Cryptographers and security engineers have spent decades explaining why secure backdoors are impossible. Yet policymakers return again and again, somehow expecting different results. It’s maddening.

Kate Robertson from the University of Toronto’s Citizen Lab nails the problem: “There have always been some officials within certain agencies that tend to view technology as a crime scene in and of itself.” This siloed thinking ignores that encryption protects hospitals, banks, national security agencies, and police services themselves.

Where Do Privacy Services Go?

As hostility toward encryption rises, companies are scrambling to find safe jurisdictions. But here’s the brutal truth: there might not be any. Joseph Lorenzo-Hall from the Internet Society puts it perfectly: “Changing your headquarters isn’t much of a plan B when the law follows your users.”

A real safe haven for privacy services needs more than just favorable sentiment toward encryption. It needs laws that actually protect companies’ ability to keep privacy promises and defend against foreign government pressure. That’s vanishingly rare.

The irony is devastating. Tools built to protect people in repressive countries could disappear precisely because democratic nations are adopting surveillance legislation that resembles authoritarian playbooks. If Psiphon leaves Canada, Iranian users lose access to one of their lifelines. That’s not collateral damage; it’s the direct consequence of policy.

What we’re witnessing is a fundamental question about which countries will compete for being the world’s privacy leaders, and which will cement themselves as surveillance states. Right now, the momentum is terrifying.

Source: WIRED’s Kernel Panic newsletter