Tech companies delivering digital services to Canadians, including cybersecurity, have written to federal ministers urging further changes to Ottawa’s lawful-access bill, saying it still creates “serious business risks” in its current form.
Known as Bill C-22, the lawful-access bill would require telecoms, internet companies and other digital service providers to make changes to their systems to give surveillance and monitoring capabilities to police services and the Canadian Security Intelligence Service.
CSIS and law enforcement have long argued that Canada is lagging behind its Five Eyes intelligence partners in not having such a lawful-access regime to aid investigations.
The government amended Bill C-22 in the House of Commons before its summer recess to address concerns, including from tech giants Apple Inc. and Meta Platforms Inc., that the bill could compromise Canadians’ cybersecurity and privacy. One such amendment explicitly protects end-to-end encryption. The bill is now due to be scrutinized in the Senate.
A letter sent to Public Safety Minister Gary Anandasangaree and Industry Minister Mélanie Joly on Thursday argues that the amendments did not go far enough.
It was signed by 20 tech organizations and companies, including security companies that provide virtual private networks, or VPNs, that encrypt a user’s internet traffic and can disguise the location where they are connecting to the internet from.
The letter expresses concerns that, even after amendments, the bill would force companies to weaken encryption or “build intercept capabilities.”
“Weakening encryption could expose customers’ sensitive financial, identity, and transaction data to criminals and other unauthorized actors,” the letter says. “A backdoor for law enforcement is a backdoor for everyone. Once built, it would permanently expand the attack surface for criminal actors and foreign adversaries.”
Among the amendments introduced by Mr. Anandasangaree in June was a change to reduce the amount of time that companies would be required to retain metadata on their customers from up to a year to six months.
The metadata would not include e-mails, web-browsing history, social-media activity or text messages, but it could include information about which telephone numbers have been in touch with each other, and data allowing someone’s location to be pinpointed.
Public Safety Minister makes changes to lawful access bill
The letter warns that requiring companies to retain personal metadata for up to six months, including information not needed for business purposes, would create a “high-value cybersecurity ‘honeypot’ target for hackers.”
Even as amended, the letter says the bill could harm Canada’s digital economy, weaken consumer trust, chill investment and damage the companies’ global competitiveness. It says Bill C-22 extends “far beyond lawful access frameworks adopted by Canada’s G7 peers.”
Yegor Sak, chief executive of Windscribe, a Canadian company providing online privacy and security tools, including a VPN service, told The Globe and Mail that the amendments in the bill were insufficient to persuade Windscribe to remain in Canada. The privately owned security company warned in May that it was considering leaving Canada over the bill. Mr. Sak, a co-founder of the Toronto-based company, which has more than 100 million registered users around the world, said he wants the government to scrap the bill.
“Bill C-22 makes Canada an untenable place for most tech companies to operate in, foreign and domestic,” Mr. Sak said in an e-mail. “It is in direct conflict with attracting the capital Canada claims to want, and literally forces existing Canadian companies to take their taxable revenue elsewhere.”
Avery Pennarun, CEO and co-founder of Tailscale, which offers a VPN service designed around end-to-end encryption, said that without further changes to the bill, the company would have to look at adjusting its corporate presence in Canada, where about 40 per cent of its global team is located.
Marsha Lederman: Is it 2026 or 1984? There is no privacy in the digital age
“Bill C-22 risks making secure infrastructure less secure by pushing providers to retain more data and build access systems that create new targets,” he said in a statement.
“Our intention is to remain a Canadian company. Without the improvements proposed in the letter, we would be weakened compared to our international competitors. We would have to pursue corporate structures that distance our international operations from Canada,” he said.
But he said moving the company wouldn’t resolve the problem because Bill C-22 is written to cover providers serving people in Canada, not just companies based here.
Nord Security, a global cybersecurity company, has a significant number of Canadian users even though it is not headquartered in Canada.
In a statement, it said the Senate now has an opportunity to strengthen safeguards in the bill.
Opinion: Canada wants kids off TikTok. It also wants the app to collect users’ photo and ID data
“The reduction of the metadata retention period from one year to six months is a step, but it doesn’t resolve the core concerns shared across the Canadian technology community, particularly around the bill’s implications for encryption and cybersecurity,” it said.
Sarah Wyld, head of policy and privacy at Tucows, a Toronto-based provider of internet services, including fibre internet, said she hoped the government would make further amendments before the bill progresses, including to protect encryption and privacy.
Simon Lafortune, spokesperson for Mr. Anandasangaree, said “the Senate now has its own independent role to play, and we respect that process and will consider any other potential amendments carefully.”
He said the language in the bill “expressly protects end-to-end encrypted information where a provider does not possess the means to decrypt it, and it does not create new authority for law enforcement to access private information without the appropriate legal authorization.”
Other signatories to the letter include the Chamber of Progress, a tech industry trade association with offices in Canada, the U.S. and EU that advocates for responsible innovation.