The takeaway: Another day, another government attempt to force tech companies to build backdoors. This time, Canada is proposing legislation that would require companies to retain certain metadata and provide law enforcement with access to it. Predictably, many tech players have sharply criticized the proposal, with some saying they would rather leave the Canadian market than comply.
The latest version of Canada's Bill C-22 would require digital services such as internet service providers, messaging platforms, email providers, and potentially hardware companies to retain up to one year of user metadata. In addition, tech companies would have to implement mechanisms that allow authorities to obtain "lawful access" to that information for criminal investigations. Critics argue the proposal amounts to another government-mandated backdoor.
During his testimony before the House of Commons Standing Committee on Public Safety and National Security, Signal executive Udbhav Tiwari said Bill C-22 would turn everyday digital tools into a surveillance network. He argued that requiring companies to retain metadata about users' communications runs counter to Signal's privacy practices.
A spokesperson for DuckDuckGo also confirmed that the company would remove its VPN service from Canada if Bill C-22 passes. NordVPN and other VPN providers have made similar statements.
Apple and Google have also joined industry warnings that the legislation could force them to weaken encryption. Last year, Apple successfully opposed a similar proposal in the United Kingdom that would have required it to build a backdoor into iCloud. The incident was the latest in a series of conflicts between the Cupertino-based company and government regulators over security and user privacy.
The primary concern is that malicious actors would inevitably discover and exploit any digital backdoor, regardless of whether it was designed exclusively for law enforcement or domestic government agencies. OpenMedia, which has described C-22 as an attempt to create a surveillance state, pointed to a late-2024 incident in which Chinese state-backed hackers compromised government-mandated police wiretap systems to steal sensitive data from AT&T, Verizon, Lumen Technologies, and other telecom providers.
Public Safety Minister Gary Anandasangaree said last week that C-22 will be amended so that digital service providers will not be required to break encryption. However, the requirement to retain metadata would remain unchanged.
A security researcher recently accused Microsoft of intentionally introducing a backdoor into its BitLocker encryption system and then attempting to silence them after they raised concerns. After the researcher publicized the exploit, Microsoft released an out-of-band mitigation but stopped short of confirming whether the flaw was intentional.
Signal, DuckDuckGo, and NordVPN threaten to exit Canada if metadata surveillance law passes
