Canada C-22 Compels Tech Firms To Build Encryption Backdoors

Canadian Bill C-22 has sparked an unlikely cross-border alliance: civil liberties groups in Canada and Republican lawmakers in the U.S. are warning that the bill’s demands on tech firms to create access to encrypted communications would create permanent vulnerabilities that threaten privacy and security on both sides of the border.

This debate isn’t theoretical. Supporters of the legislation argue law enforcement needs stronger tools to pursue terrorists and organized crime in an era of encrypted messaging, while critics say building systemic access points into products is a permanent, dangerous change to how modern communication works. The real fight is over whether governments can compel companies to redesign systems in ways that make everyone less safe.

There’s momentum behind the pushback. A well-known Canadian legal group delivered a petition to Parliament with more than 42,000 signatures opposing the bill, a sign that a sizeable chunk of citizens view the proposal as an overreach. Those signatures landed squarely at the feet of Prime Minister Mark Carney, whom opponents see as the bill’s chief backer.

At a news conference before delivering the petition, board member John Robson made the stakes plain to the crowd and to the cameras. “I’m here on Parliament Hill today because we are delivering a petition with 42,344 signatures asking Parliament not to proceed with Bill C-22 … because [Prime Minister Mark Carney] is the moving force behind this bill, and we’re hoping to persuade him that all these signatures from Canadians across the country … represent legitimate, serious concerns about the scope of this bill,” Robson said.

Robson underlined the practical problem: service providers would be pushed to gather and structure Canadian users’ electronic data for government extraction. “are concerned about Bill C-22 because it would require service providers to compile Canadians’ electronic data, to develop systems for extracting information from it and turning it over to the government.” The objection is not to law enforcement itself, he added, but to blunt, sweeping tools that sweep up ordinary people.

“It’s not that Canadians … are against law enforcement having appropriate powers, including to fight organized crime,” Robson said. “It’s one more ham-fisted way of targeting ordinary, law-abiding people instead of adopting tailored measures suitable to the real crime problems. And privacy is not a luxury in a free society.” Those words echo a core Republican concern: preserving individual liberty while supporting targeted law enforcement, not blanket mandates that weaken defenses.

U.S. legislators have stepped in with direct warnings, stressing that the bill could force American companies to alter their systems in ways that reach into U.S. privacy. “Canada’s Bill C-22, currently under consideration in Parliament, would drastically expand Canada’s surveillance and data access powers in ways that create significant cross-border risks to the security and data privacy of Americans,” the lawmakers wrote, flagging an obvious national-security problem.

They didn’t stop there. “We write to express our concerns that, if enacted, Bill C-22 would allow Canadian government officials to compel American companies to build backdoors into their encrypted systems, thereby introducing systemic vulnerabilities that could be exploited by hackers, foreign adversaries, and cybercriminals.” The language is stark because the technical reality is stark: deliberate weaknesses invite exploitation.

Regulators and industry observers also worry about secretive authority baked into the bill. The lawmakers warned the measure’s wording could enable secret ministerial orders and compel redesigns that cannot be geographically contained. “If a U.S.-based provider is forced to redesign its system to facilitate Canadian authorized access to content that is currently inaccessible even to the provider itself, the resulting capability cannot be geographically limited,” they wrote. “This directly threatens the privacy of U.S. persons who expect and depend upon robust encryption to protect sensitive communications, health data, financial records, and personal correspondence from unwarranted intrusion.”

Practical consequences are already surfacing: some VPN services threaten to exit the Canadian market rather than comply, and technologists warn that any mandated backdoor is a target for attackers. Lawmakers on both sides argue that weakening encryption to please one government creates risk for everyone and undermines trust in services used worldwide.

The clash over Bill C-22 is a broader fight about where to draw the line between public safety and private security. Republicans pushing back here are clear-eyed: support for law enforcement is real, but it cannot come at the cost of introducing permanent systemic weaknesses that adversaries will exploit. The debate now moves from warnings into choices for lawmakers who must decide whether to demand tools that sweep broadly or to craft narrowly tailored authorities that leave strong security intact.

https://x.com/thejohnrobson/status/2057901624366903674?s=20