What Would Canada’s Surveillance Plan Require Platforms to Do?

Canada is contemplating surveillance legislation that could increase data retention and effectively mandate backdoors in encrypted services, Wired reports. Signal says it would exit the Canadian market over changes the legislation would require to its open-source projects. Psiphon, the Canadian anti-censorship company, says it would leave the country if the bill passes. Those are conditional responses to a proposal, not evidence that the law has taken effect or that either service has departed.

The proposed obligations, as Wired describes them, concern keeping more information and enabling greater access to protected data. Those duties need separate examination. The supplied account does not establish the precise statutory wording, the covered providers, or the limits on orders. Without those details, a claim that every affected service would face an identical technical mandate would outrun the evidence.

Granted, investigators can have legitimate reasons to seek digital evidence. A targeted order for records a provider already possesses can help an investigation without requiring the provider to redesign its encryption. The strongest case for additional authority would identify an investigative gap, explain why existing powers cannot address it, and limit the new obligation accordingly. Privacy protection does not require pretending that evidence has no public value.

Disclosure and redesign grant different powers

Still, an order to disclose existing information differs from a requirement to create a way to read information the provider cannot currently access. In an end-to-end encrypted service, the latter could require changes to the security architecture. Additional retention can create a different risk by accumulating records that would otherwise not exist. A narrowly addressed warrant does not, by itself, make the underlying engineering change narrow.

Wired reports that cryptographers and security engineers have consistently rejected the claim that intentional access weaknesses can be built safely. That is a substantial reason for scrutiny, not a substitute for analyzing this proposal. The supplied reporting does not demonstrate a newly exploited Canadian backdoor. The concern is prospective: a compelled access mechanism could introduce vulnerabilities whose consequences extend beyond the intended investigation.

Provider resistance also has practical stakes. Wired reports criticism from Apple and Meta, while DuckDuckGo and NordVPN say they would consider withdrawing services. Psiphon’s work keeping millions of Iranians connected during internet shutdowns gives its threatened departure a consequence beyond Canadian customers, though the report does not establish that relocation would interrupt that work. Exit threats show the choices providers say they face. They do not independently prove the bill’s technical effects.

If the legislative language limits orders to existing records and excludes compelled security redesign, the case that it mandates encryption backdoors would narrow. If the text requires providers to create access capabilities, independent technical analysis should identify the necessary changes and their risks. Canadian lawmakers can clarify that boundary before passage. The decisive evidence is the obligation providers would inherit, not the reassurance attached to it.