Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here. The Great White North is the latest country to contemplate legislation that could essentially mandate backdoors and increase data retention in encrypted services.
The proposed changes have prompted the Canadian anti-censorship company Psiphon VPN—which keeps millions of Iranians online during repressive internet shutdowns—to say it will leave the country if the bill passes. And Psiphon is not the only one. Encrypted messaging app Signal has said it would exit the Canadian market because the legislation would require unacceptable changes to its open source projects.
Apple and Meta have criticized the bill, and DuckDuckGo and NordVPN say they would consider pulling their services, too. But as countries around the world contemplate similar legislation, even larger questions begin to emerge about which states or regions could differentiate themselves as being safe havens for privacy services if global hostility to encryption continues to rise. It’s been maddening and disturbing to see more and more democratic countries around the world propose changes to their surveillance and data collection laws, with the aim of giving cops and intelligence agencies greater powers to access people’s information.
Governments already have broad digital surveillance powers and investigative tactics to solve crimes that involve encrypted data, but legislative proposals almost inevitably include provisions to expand this access even more—mandating additional logging and what amounts to backdoors or intentional flaws in encrypted products, which cryptographers and security engineers have consistently said cannot be built safely. Truly everyone who understands the issue has said it as much for decades. Yet policymakers return again and again to the idea, somehow expecting a different conclusion or a new breakthrough that will make it all possible.
Other encryption-threatening proposals have also emerged in the EU, France, India, Ireland, Spain, Sweden, Switzerland, and others. While not all measures have passed into law or been enacted, the hostility is clear. First proposed in 2025, and partially revised due to blistering criticism from tech companies and civil society, Canada’s C-22 bill can broadly place requirements on tech companies, including those outside of Canada, to introduce “technical capabilities” that allow data to be accessed for law enforcement purposes.
Like many such bills, C-22 says that companies will not have to introduce a “systemic vulnerability” into their systems. But opponents have pointed out that any capability to access end-to-end encrypted data amounts to a backdoor that could be discovered and abused by anyone. And this risk is only heightened even more by the ease with which anyone can now use AI tools for reverse engineering and system mapping.
Extract — continue reading at the source.
