Canada's Bill C-22 Wants Your Metadata and Encryption Backdoors

Canada's Parliament is debating a massive expansion of surveillance powers, and Canadians are running out of time to stop it. Bill C-22, also called the Lawful Access Act, has already passed the House of Commons and is now before the Canadian Senate. The Electronic Frontier Foundation and the Canadian Civil Liberties Association are both calling for Canadians to speak out before it becomes law [1].

What the bill does

Bill C-22 gives the government new powers to force digital services, including telecom companies, messaging apps, and more, to help with government surveillance. The most dangerous provision allows Canada's Minister of Public Safety to order companies to create a backdoor to their services for law enforcement, as long as it does not lead to a "systemic insecurity." That qualifier is doing a lot of heavy lifting, and privacy advocates say it is a clear recipe for weakening the encryption we all rely on [2].

The bill also requires services to retain metadata for up to a year. Metadata reveals who people communicate with, where they go, and what services they use, even when they are not suspected of any crime. This is mass surveillance infrastructure dressed up as a technical requirement [3].

The cross-border problem

Bill C-22 could also expand the sharing of Canadians' personal data with foreign law enforcement, including the United States. Canada has been negotiating a cross-border data-sharing agreement with the U.S. that would allow American police to get information about Canadian internet users without any Canadian court oversight. That means a Canadian citizen's metadata, retained under C-22, could end up in the hands of a foreign government's police force, with no Canadian judge involved [4].

What researchers found

Researchers at CCLA and Citizen Lab published a detailed analysis of C-22 and its constitutional and cybersecurity problems. Their conclusion is that the bill needs more than cosmetic changes. They call for entirely withdrawing Part 2 of Bill C-22, the section that establishes the surveillance and data retention regime [5].

Some Canadian senators have already expressed concerns about the bill. During a Senate debate on October 8, several senators suggested, as CCLA and Citizen Lab have, that it may not be compatible with privacy protections in the Canadian constitution [6].

The encryption backdoor debate, again

The "systemic insecurity" language in C-22 is the latest attempt to thread an impossible needle: mandate access for law enforcement without technically breaking encryption. Every serious cryptographer who has studied this problem has reached the same conclusion. You cannot create a backdoor that only the good guys can use. If a service has a way for law enforcement to access content, that same way is available to anyone who discovers it, including hostile governments, criminals, and abusive partners [7].

The EFF points out that forcing companies to weaken their services has consequences far beyond the specific investigations that prompted the law. Once a backdoor exists, it exists for everyone. The compromise that satisfies a Canadian minister today becomes the vulnerability exploited by a foreign intelligence service tomorrow [8].

What Canadians can do

The CCLA is urging all Canadians to sign its petition opposing the bill. The EFF has a separate action campaign to tell the Canadian Senate to stop C-22. Both are linked below. The Senate is the last chance to stop this before it becomes law [9].

If you are not in Canada, pay attention anyway. Surveillance laws tend to copy each other. The "lawful access" framework in C-22 is not unique to Canada. Similar provisions have been proposed in the UK, Australia, and the EU. If it passes in Canada, it will be cited as precedent elsewhere [10].