Psiphon says it will leave Canada if lawful-access Bill C-22 passes as written

Psiphon, the Toronto-based company behind one of the most widely used tools for evading state internet censorship, says it will move its operations out of Canada if the federal government's lawful-access bill passes in its current form. The plan was reported by The Globe and Mail and highlighted by the Citizen Lab, the research centre where Psiphon got its start.

What Bill C-22 would require

According to the Citizen Lab's account of the Globe and Mail report, Bill C-22 would compel electronic service providers to quietly modify their systems so that police services and the Canadian Security Intelligence Service (CSIS) gain surveillance and monitoring capabilities.

For Psiphon, that obligation clashes directly with the product's core promise. The company says complying would force it to weaken important safeguards built to protect the privacy of its users, and that it is therefore prepared to relocate rather than accept those changes.

From research project to 20 million users

Psiphon began in 2006 as a project at the Citizen Lab and was spun out into a private company shortly afterwards. It now reports 20 million monthly users worldwide, many of whom rely on the software to bypass online censorship in countries such as Iran, Myanmar, Russia and China.

That user base is what elevates the company's exit threat beyond a routine corporate relocation. Psiphon's entire purpose is to serve people whose governments monitor, filter or restrict their access to the internet. A legal mandate to build interception hooks into its systems for Canadian authorities sits uneasily beside a product whose users include people targeted by their own security services.

A warning about the wider ecosystem

Ron Deibert, the Citizen Lab's director and founder, framed Psiphon's decision as a preview of broader damage. Bill C-22, he said, "will make it impossible for a large number of invaluable privacy-preserving tools and applications from operating in Canada."

If that assessment proves accurate, the bill's reach would extend well beyond one VPN provider. Any service whose value rests on not holding interception capabilities — encrypted communication tools, anonymity infrastructure, privacy-focused platforms — could face the same choice between leaving the country and changing what they offer.

Why it matters

The standoff is a concrete test of the trade-offs built into lawful-access legislation. A requirement to secretly alter systems for police and intelligence access may look, from an investigative standpoint, like a narrow technical mandate; to a privacy-preserving service, it is an existential one, because the product's guarantees cannot survive the capability itself.

It is also notable that this is happening in Canada. Psiphon was built to counter censorship abroad, in places such as Iran and Myanmar, yet its leadership now argues that Canadian legislation could push it out of its home country. For the company's users, jurisdiction is not a technicality: the country a provider operates in determines what it can legally be compelled to do to its systems, and by extension how much its privacy commitments are worth. A departure would also signal to other security and privacy companies that Canada is a riskier place to base operations, with knock-on effects for the country's technology sector that regulators have yet to weigh.