Bill C-22 would allow the government to require surveillance capabilities be built into any communications technology in Canada that could be accessed by law enforcement.Sean Kilpatrick/The Canadian Press
Kate Robertson is a senior research associate at the University of Toronto’s Citizen Lab.
The Senate has just begun debate on the hugely controversial Bill C-22, or the Lawful Access Act. If passed, the bill would empower the government to require surveillance capabilities be built into any communications technology in Canada that could be accessed by law enforcement, and to force the stockpiling of all Canadians’ sensitive metadata. The law would apply to everything from smartphones to smartwatches, banking to health apps, video game platforms, and public WiFi or CCTV networks.
The bill has drawn heavy criticism for endangering Canadians’ cybersecurity and for violating constitutional standards. The law would require mathematicians to transform into magicians. For decades, cybersecurity experts have dispelled the magical thinking that there is a way to engineer access for law enforcement that doesn’t also potentially allow malevolent threat actors to enter. By threatening to expose communication and encryption providers to secret orders forcing backdoors, the bill has generated wide-ranging calls for reversal, from journalists and financial institutions to world-leading experts on gender-based violence and cybersecurity.
The calls reflect a broad consensus: that encryption is vital to fundamental rights, the economy and national security, and that compromising encryption undermines those things along with it.
Since the government strained to justify its proposal in Parliament in June, major shifts in the AI-fuelled cyberthreat environment have generated even more headwinds. In July, the world learned that rogue AI agents from OpenAI broke out of their sandbox and conducted a co-ordinated cyberattack against a software company, Hugging Face; other companies have since reported similar incidents. AI technologies have also hacked or tried to hack government websites in the U.S., Australia and Canada. The revelations arrived during worldwide alarm about the autonomous cyber-capabilities of Anthropic’s new Claude Mythos, a model deemed too powerful to release publicly.
When questioned in May about Bill C-22’s threat to Canada’s security architecture, the Department of Public Safety testified that they expect technology companies to thread this needle when complying with new surveillance obligations. But technology companies, cybersecurity experts, and international standards bodies themselves have been sounding the alarm about cybersecurity dangers in the law. Moreover, transformations in the cyberthreat landscape are still unfolding. As Canada’s Finance Minister described: “The issue that we’re facing with Anthropic is that it’s the unknown unknown.”
The assumption by government officials that technology companies can find “safe ways” to weaken critical cybersecurity protections badly misreads the current threat landscape. The state of play in today’s world is defined by cyber-insecurity. In Britain, the cyber wing of the GCHQ reported a significant increase in nationally significant cyber incidents, including “an almost 50 per cent increase in highly significant incidents, an increase for the third consecutive year.” They warn that Britain is facing a ”perfect storm,” and assess that half of the world’s countries now have the ability to hack into Britain’s companies and private networks.
Data collected by law enforcement is no safer. Just last month, the FBI was victim to a staggering breach that siphoned the personal information of FBI personnel to cyberattackers. Only a few years ago, law-enforcement backdoors were also compromised in the U.S. as part of a massive attack against telecommunication networks. The severity of these breaches lies in their enormous cost to national security and operational capabilities. This month a police service in Ontario is also revealing the extent of a significant cyberattack last year.
Why would Canada unilaterally disarm in such an environment? In 2024, in response to even non-AI-threat activities at the time, U.S. law enforcement urged the public and government officials to communicate using strongly encrypted applications like Signal and WhatsApp. These are the very communications systems that Canada’s new law would upend.
But the security landscape is not the only thing that’s changing. With the collapse of U.S. trade talks, the Canadian government has made the economy a national priority, and the Prime Minister has championed efforts to strengthen our relationship with Canada’s European allies. Canada and the European Union are soon expected to strike a trade agreement to integrate their digital economies.
But Bill C-22 risks undermining his efforts to date. Both European civil society organizations and technology providers are urging European and Canadian governments to first fix Bill C-22’s sweeping metadata retention regime and threats to encryption. European courts have found similar anti-encryption and metadata retention measures to be inconsistent with fundamental rights. European digital rights groups were blunt: “A partner cannot credibly seek deeper digital integration while legislating the power to compel European providers to weaken their products in secret.”
If this bill isn’t revised then all companies doing business in Canada will have a maple letter tattooed to their corporate charters: how can any customers know whether the Canadian government has secretly poisoned the company’s security and privacy guarantees? Is a product really protecting user privacy and complying with the European privacy laws? Market trust questions aren’t theoretical. In Australia, the very existence of such powers was shown to have had a significant economic harm to Australia’s technology sector. For example, one company said that loss of trust cost them an estimated $1-billion Australian dollars in economic damage.
Take, as just one major example, Canada’s growing AI sector. The bill will extend to AI technologies and developers themselves, such as Toronto-based Cohere, and the requirements that the government could impose on AI providers are broad, potentially including compelling AI agents to work for the police rather than for users. Equally concerning is the bill’s application to the growing sector for private computing, such as Cohere’s Model Vault, that is geared for more privacy-protective uses of AI models.
The government’s handling of the encryption issue thus far has done little to inspire public trust. After the Minister of Public Safety committed in May to amend the bill to “ensure that encryption will not be compromised,” the government blocked further debate in committee. The government did pass an amendment but it wasn’t even a fig leaf: the public safety minister publicly admitted as much this summer when he stated that the bill does, in fact, still permit the government to compromise encryption in what he describes as “extenuating” situations.
Ultimately, proposals to compromise encryption and force the stockpiling of metadata are divorced from the reality of today’s threat and economic landscape. Fortunately there is still time to reverse course to ensure that Canadians enjoy strong security, positive economic relations with European allies, and to avoid blundering into an insecure and secret-by-default surveillance regime.