Imagine you live in a secure apartment building. You’ve changed the locks, added a deadbolt, and installed a camera in the hallway. Then, one day, the government passes a rule requiring you to hand a master key to the building manager, just in case inspectors need to get in. The law says the key will only be used for serious matters, and it won’t be copied or abused. But the key exists. It can be lost, stolen, reproduced, or demanded by someone else. That is the uncomfortable reality at the heart of Canada’s Bill C-22. First proposed in 2025, and then partially rewritten after a storm of criticism from privacy advocates, civil society groups, and major technology companies, the bill would give Canadian authorities broad new powers to force companies—even those with no offices or servers in Canada—to build “technical capabilities” into their products so that law enforcement can access encrypted data when authorized. On the surface, this sounds reasonable. It is framed as an effort to help police investigate serious crime, terrorism, and child exploitation. But underneath, it raises a deeply uncomfortable question: how can a system be both secure and deliberately breakable at the same time? The bill claims that companies will not be forced to introduce a “systemic vulnerability.” Yet any mechanism that allows a third party to bypass encryption is a vulnerability, no matter what phrase you use to describe it. If a messaging app has a way to turn over readable messages, then somewhere in the code there is a door. That door may be locked, but keys can be copied and locks can be picked. Once the door exists, it is only a matter of time before someone other than the intended keyholder discovers it. And in today’s world of artificial intelligence, automated scanning, and reverse engineering, that time may be very short indeed.
Encryption experts have spent years trying to explain this simple truth to lawmakers: there is no such thing as a backdoor that only the good guys can use. A backdoor is a backdoor. It is an entrance that bypasses the security measures you rely on. It can be exploited by criminals, foreign governments, hackers, or anyone who manages to find it. The tech industry has repeated this warning so often that it can sound like a mantra, but the warning is no less true for being familiar. Members of the US House Judiciary and Foreign Affairs Committee made the point explicitly in a May letter to Canadian officials, warning that “companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption.” Their concern was not abstract. The letter reflected a growing bipartisan understanding in Washington, and in many other capitals, that weakening encryption is not a smart response to crime. It is a gift to those who would do us harm. And the dangers have only grown as artificial intelligence tools become more powerful and more accessible. What used to require a team of highly skilled programmers can now be done by a single person with an AI-assisted code analyzer. These tools are not rare. They are available online, sometimes for free. This means that a vulnerability hidden inside an app is far more likely to be found and weaponized than ever before. Opponents of C-22 are not saying that law enforcement should be helpless. They are saying that requiring companies to deliberately weaken security is the wrong way to solve the problem. It directs law enforcement toward a strategy that is not only technically dubious, but actively dangerous to the people it is meant to protect.
Beyond the encryption backdoor issue, C-22 also contains provisions that could force companies to keep metadata about their users’ activity. At first glance, metadata may sound less scary than reading the contents of a private message. But metadata is its own form of surveillance. It reveals who you talked to, when you talked, how often, from where, and for how long. It can paint an intimate portrait of a person’s life: their friendships, their work habits, their medical appointments, their political leanings, their late-night conversations. Many privacy-focused services, including VPN services from companies like Psiphon and DuckDuckGo, have built their entire business model around avoiding the collection of metadata. They hold as little data as possible because they believe their users’ trust is more valuable than any marketing insight or future government request. If C-22 passes in its current form, these companies would be forced to change that design principle. They would have to start collecting data they do not need, do not want, and intentionally chose not to have. That is not a small change. It is an existential threat to their reason for existing. Afsaneh Ri got, the founder of the De|Center, a research organization focused on reducing technological harms, put it plainly: “If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it.” In other words, the government is not just asking to look at existing records. It is asking companies to build a surveillance system from scratch, to embed it into the fabric of everyday tools, and to do so quietly. Even if no data is ever requested, the capability itself changes the relationship between users and their communications. A tool that was once a private room becomes a room with a hidden microphone, supposedly switched off, but still there.
There is also a global dimension to this legislation that is easy to miss when focusing on Canada alone. Laws like C-22 rarely stay contained within one country. As Rigot warned, “There are contexts like Iran and other contexts globally, who all of this has a trickle effect on. It’s not going to stay in Canada because these types of laws always get copy pasted around the world.” Consider what it would mean if other governments adopted similar laws, demanding backdoors and metadata retention from the same companies. A privacy tool that was forced to weaken its security for Canadian authorities would not be able to claim that it had no weaknesses when a less democratic government came calling. The technical capability, once built, is universal. It cannot be switched off for certain users or jurisdictions. The result is that countries with strong protections for free expression and human rights would be handing surveillance tools to regimes that have no respect for those values. Journalists, political dissidents, human rights defenders, and ordinary citizens living under authoritarian governments would lose one of the few resources they have to communicate safely. The very people who rely most on encryption are often the ones with the most to lose if it fails. They are not just privacy enthusiasts. They are activists organizing protests, whistleblowers exposing corruption, lawyers defending clients in politically charged cases, and everyday people who simply want to talk about their lives without being monitored. For them, encryption is not a luxury. It is a lifeline. And a law passed in Ottawa, however well-intentioned, could have devastating consequences far beyond Canada’s borders.
As more countries contemplate laws like C-22, developers who build privacy tools are increasingly thinking about where they should base their operations. Some consider moving to jurisdictions with stronger legal protections for encryption and data privacy. But finding a safe harbor is not as simple as packing up a startup and moving across the world. Joseph Lorenzo-Hall, security portfolio lead at the Internet Society, explains why: “Changing your headquarters isn’t much of a plan B when the law follows your users, as C-22 would.” This is a crucial point. If your service is available to users in Canada, Canadian law can reach you even if your office is elsewhere. You cannot simply choose which country’s laws apply to you when your users are global. The idea of hiding behind borders is increasingly obsolete in a digital world where data flows everywhere. Lorenzo-Hall also points out that the strongest protection has always been holding as little user data as possible. But that defense collapses if the law can force you to start collecting it. “We don’t have it” is no longer an excuse if governments can legally say, “then build a system to get it.” A true safe haven, he argues, needs more than favorable winds around strong encryption. It needs legal structures that allow companies to keep their privacy promises and protect them against foreign threats to confidentiality and integrity. It needs laws that say, not just that encryption is allowed, but that companies cannot be forced to undermine it. Without that kind of protection, privacy-focused companies will always be one legislative session away from being turned into surveillance tools.
This is the deeper story behind C-22. It is not simply a technical disagreement about encryption or a bureaucratic argument over data retention. It is a conversation about what kind of society we want to live in, and what kind of tools we allow to exist. The impulse behind the bill is understandable. Governments have a duty to protect their citizens, and serious crimes are often planned and coordinated through encrypted channels. But the answer cannot be to hollow out the very security that our digital lives depend on. We have seen time and time again that surveillance powers, once created, tend to expand. Tools that are built for the most urgent cases become routine. Data that is collected because it might be useful one day becomes a database that is queried for all sorts of reasons. The risks are not hypothetical. They are the lessons of history. If we are going to have a real debate about encryption and law enforcement, it should be an honest one. It should acknowledge that there is no perfect solution, that security and privacy sometimes pull in opposite directions, and that there are no simple choices. But it should also recognize that deliberately weakening encryption is a choice with enormous costs. It undermines trust in digital infrastructure. It makes everyone less safe. And it will not stay contained in one country. The companies and advocates resisting bills like C-22 are not opposed to public safety. They are trying to protect something more fragile and more precious: the ability of humans to communicate honestly, privately, and freely. In the end, that is not just a technical issue. It is a human one. We should treat it with the care it deserves, before it is too late. Stay safe out there.
