VPN and security firms urge Ottawa to amend Bill C-22 over encryption risks
A coalition of 23 technology companies and industry groups, including Toronto-based Tailscale and Windscribe and the owners of NordVPN and ExpressVPN, has asked the federal government to amend Bill C-22 before it becomes law. The open letter, dated Sept. 24 and organized by the U.S. industry group Chamber of Progress, was sent to Public Safety Minister Gary Anandasangaree and Industry Minister Mélanie Joly.
The bill would give police and the Canadian Security Intelligence Service broader access to Canadians' digital information held by service providers. It applies to digital providers with Canadian users, wherever those providers are based, BetaKit reported. For users of VPNs, encrypted messaging and secure networking tools, the outcome could determine whether those products keep working the same way in Canada.
What the companies object to
The letter does not propose specific wording. It raises three main concerns:
- Encryption: despite recent amendments, the signatories say the bill could still require providers to weaken encryption or build interception capabilities. "A backdoor for law enforcement is a backdoor for everyone," the letter says.
- Metadata retention: companies could be required to keep sensitive metadata for up to six months, including data they do not otherwise collect. The government has already cut the proposed period from one year to six months.
- Secret orders: the term "core provider" is undefined, and even non-core providers could face secret ministerial orders to change code or security architecture. Because the orders are secret, customers could not tell which companies had received one.
Who signed
Canadian signatories include Tailscale, Windscribe, Fredericton's Beauceron Security, domain and internet services firms Tucows and easyDNS, logistics firm GoBolt and Coinbase Canada. International signatories include Kape Technologies, which owns ExpressVPN and Private Internet Access, Nord Security, encrypted email provider Tuta and Nym Technologies.
Tailscale chief executive Avery Pennarun said Canada should be able to support legitimate investigations without making secure systems easier to attack. Windscribe CEO Yegor Sak told BetaKit the bill would make Canada an "untenable" place for tech companies to operate. Tailscale told The Globe and Mail it would have to pursue corporate structures that distance its international operations from Canada if the bill passes unchanged.
Why it matters
Security vendors have long argued that any mechanism built for lawful access can be found and abused by criminals or foreign intelligence services. For Canadian companies that sell privacy and security products abroad, the concern is also commercial: customers may avoid a provider that could be compelled to change its product in secret.
Bill C-22 is still before Parliament. The letter asks that changes be made before it passes.
