Toronto-based Psiphon, whose VPN technology is used in countries including Iran, China and Russia, says Bill C-22 could compromise privacy protections at the heart of its anti-censorship software.
“We spend our days protecting people from authoritarian surveillance,” Psiphon vice president Kenzie Elsworthy told The Globe and Mail. “This bill would compel Psiphon to help build an arbitrary surveillance system in Canada.”
Founded out of the University of Toronto’s Citizen Lab, Psiphon now reaches roughly 20 million monthly users worldwide, including millions in Iran and Myanmar. Ottawa also gave Psiphon $685,000 this year to improve what it called the “world’s largest and most capable anti-censorship platform.”
Meanwhile, Elsworthy said Psiphon has already begun plans to relocate.
“We do not want to leave Canada. We were built here, originally out of the University of Toronto, and we have been here for nearly 20 years,” she said.
“But if this bill passes as written, relocating is the only way the work continues.”
Psiphon’s software is open source, meaning its code can be publicly inspected, adding additional problems to the Carney government’s plans.
“You cannot build a secret backdoor into open-source code,” Elsworthy said. “Every line we ship is public.
“Any access capability this bill forces us to build would be visible to the whole world, including the authoritarian governments our users are trying to escape. That is not lawful access. It is a published vulnerability.”
Bill C-22, the Lawful Access Act, would require certain telecom and electronic service providers to maintain technical capabilities allowing police and CSIS to access information they are legally authorized to obtain.
Ottawa says the bill does not authorize mass surveillance or direct access to company systems and exempts obligations that cause a “systemic vulnerability.” However, Privacy Commissioner Philippe Dufresne has warned the safeguard may not fully protect encryption.
The bill would also allow Ottawa to require certain providers to retain metadata for up to one year and let authorities demand, without prior judicial authorization, confirmation that a provider serves a particular subscriber or account.
The Canadian Bar Association has questioned the need for the expanded powers, warning they could extend beyond tech companies to universities, hospitals, law offices and media outlets.
Psiphon, however, is not alone in threatening to leave.
Signal has said it would “rather pull out of the country than be compelled to compromise” its privacy promises, while DuckDuckGo has said it would remove its VPN service from Canada if Bill C-22 passes.
Proton VPN, NordVPN and Toronto-based Windscribe have issued similar warnings, while Apple, Google and Meta have raised privacy and cybersecurity concerns.
Apple previously warned the legislation could force companies to break encryption by inserting backdoors, “something Apple will never do.”
The Liberals split Bill C-22 from Bill C-2 amid privacy concerns and later added safeguards. It passed the House in June and is now before the Senate.
Public Safety Minister Gary Anandasangaree, who has defended the legislation, says Bill C-22 would give police and CSIS the “essential tools they need” when digital investigations stall.
His office has also rejected suggestions that a lawful access framework makes privacy-focused services impossible to operate in Canada.
“The existence of a lawful-access framework does not, on its own, make it impossible to operate a secure, privacy-protective service in Canada,” spokesperson Simon Lafortune told The Globe.
Conservative Leader Pierre Poilievre accused the Liberals of trying to turn the tech sector into a “gigantic surveillance arm of the state,” which he said, “will kill many jobs and drive many of the best businesses out of our country.”
The NDP and Green Party have also raised objections.