Encryption Is Getting Squeezed From All Sides
Canada's proposed C-22 bill threatens encryption, prompting companies to consider leaving the country.
Run Signal?
Get an email when a reviewed story names Signal, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Canada's proposed C-22 bill, aiming to enhance law enforcement access to encrypted data, is facing significant backlash from privacy-focused tech companies. Critics argue that mandated backdoors or intentional flaws in encryption, even if not systemic vulnerabilities, pose a severe risk that could be exploited by malicious actors, especially with the rise of AI-powered reverse engineering. Several companies, including Signal and Psiphon VPN, have indicated they may exit the Canadian market if the bill passes, highlighting a global trend of increasing government pressure on encryption.
The lesson from this incident
Full lessonCanada's Bill C-22 exemplifies a growing global trend where governments seek mandated access to encrypted communications, fundamentally undermining the security architecture that protects billions of users. Intentional cryptographic weaknesses — even those framed as 'lawful access' mechanisms — create exploitable vulnerabilities that malicious actors, foreign adversaries, and AI-powered reverse engineering tools can leverage. The departure threats from privacy-focused companies like Signal highlight that weakened encryption doesn't just affect criminals; it erodes trust and security for all users. This matters because once a backdoor exists, it cannot be selectively opened — it becomes a systemic risk for every individual, business, and critical infrastructure system relying on that encryption standard.