Canada's Bill C-22 Would Order Encryption Backdoors as It Reaches the Senate

Canada's House of Commons has passed Bill C-22, legislation that would substantially expand government surveillance powers over digital services, and the bill now sits with the Canadian Senate. According to the Electronic Frontier Foundation (EFF), whose warning about the legislation surfaced on the front page of Hacker News, Canadians still have a window to oppose the measure before it becomes law.

What the bill would do

The EFF describes Bill C-22, formally known as the Lawful Access Act, as giving the government new authority to compel digital services — telecom companies, messaging apps and others — to assist with surveillance operations.

Its most contested provision would let Canada's Minister of Public Safety order a company to build a backdoor into its own service for law enforcement, provided the order does not produce a "systemic insecurity." The EFF contends the qualifier does little in practice, arguing the provision would weaken the encryption that every user of those services depends on.

The bill would also obligate services to retain metadata for up to a year. As the EFF points out, metadata exposes who people communicate with, where they go and which services they use — and this stockpiling would apply even to people who are not suspected of any crime.

Constitutional and cybersecurity criticism

Researchers at the Canadian Civil Liberties Association (CCLA) and Citizen Lab have published a detailed analysis of the bill, identifying what they describe as serious constitutional and cybersecurity flaws. Their conclusion, relayed by the EFF, is that the legislation needs far more than surface-level amendments: the researchers want Part 2 of C-22 — the section that establishes the surveillance and data retention regime — withdrawn in full.

Some Canadian senators have already voiced reservations, and according to the EFF they have echoed the researchers' assessment that the bill may conflict with the privacy protections guaranteed under the Canadian constitution.

The cross-border dimension

C-22 could also widen the sharing of Canadians' personal data with foreign law enforcement, including the United States. According to the EFF, Canada has been negotiating a cross-border data-sharing agreement with the U.S. that would allow American police to obtain information about Canadian internet users without any oversight from a Canadian court.

Why it matters

For operators of telecoms, messaging apps and other online services, the bill would create legally enforceable duties to assist surveillance — and, under the backdoor provision, to deliberately engineer access into their own products. The EFF's position is that any such mandate amounts to weakening encryption for all users of a service, not only the targets of an investigation.

For ordinary users, the retention requirement means a full year of communication patterns, movements and service usage would be collected and stored regardless of any suspicion, capturing the digital lives of people with no connection to a crime.

The cross-border element adds a further layer: personal data could end up in the hands of foreign police without a Canadian judge ever reviewing the request.

With the House of Commons already on board, the Senate is effectively the final checkpoint before the bill becomes law. The CCLA is running a petition calling on Canadians to oppose C-22, and the EFF is urging people to make their positions known to senators while the legislation remains under review.