- Canada's Bill C-22, the Lawful Access Act, 2026, sets a framework for service providers to help authorized persons reach information. Wired says it can require technical capabilities.
- Wired reports that Signal and Psiphon say they would leave Canada if the bill passes. Opponents argue any access capability in encrypted systems can be found and abused.
- Leaders should list the encrypted tools their staff rely on, note where each vendor operates, and plan for a vendor leaving a market.
What the bill does
Bill C-22 is before Canada's House of Commons. Its short title is the Lawful Access Act, 2026. The bill has three parts.
Part 1 changes existing laws, including the Criminal Code. The aim is to speed up how investigators collect data. Part 2 adds a separate law, the Supporting Authorized Access to Information Act. It sets a framework so electronic service providers can help authorized persons use their access powers. Part 3 calls for a parliamentary review of the first two parts.
Part 1 matters even before encryption comes up. Telecom providers could be required to confirm whether a person is their customer. The bill defines subscriber information broadly. It covers name, address, phone number, email address, account numbers and the devices a customer used. A judge could also let an officer send a production request to a foreign provider of telecom services.
That 30 days runs from the date the judge grants the authorization. The excerpt reviewed for this story stops before the detailed Part 2 duties. We cannot confirm from it what technical duties Part 2 sets.
Where encryption enters
For the encryption angle, we rely on Wired. Its Kernel Panic newsletter says C-22 can broadly require tech firms to introduce "technical capabilities" so police can reach data. Wired says this can reach firms outside Canada. It adds that the bill says firms need not create a "systemic vulnerability."
Here is the mechanism. In end-to-end encryption, only the sender and the recipient hold the keys. The provider carries scrambled messages and cannot read them. It can still hand over account details, which the bill's subscriber definition covers. Reading message content would take a new capability built into the product.
Opponents told Wired that any such capability is a backdoor. They say anyone could find and abuse it. Wired adds that AI tools now make reverse engineering and system mapping easier. That is Wired's view. It suggests a hidden entry is easier to find than before.
Vendors are already answering
Wired reports that Psiphon will leave Canada if the bill passes. Psiphon is a Canadian anti-censorship company. Wired says it keeps millions of Iranians online during shutdowns.
Wired puts Signal on the same list. The messaging app objects to what the bill would demand of its open source projects. Wired says Apple and Meta have criticized the bill. DuckDuckGo and NordVPN say they would consider pulling their services.
The critics' case: a door for police is a door for everyone
Debates about encryption often treat access as a feature for one party. Critics argue it works more like a master key to a building. Anyone who copies or finds the key can use it, and every tenant lives behind the same lock.
The bill's "systemic vulnerability" carve-out is where the dispute sits. Supporters can point to it as a limit. Opponents, per Wired, say any capability to reach end-to-end encrypted data is a backdoor anyway.
Kate Robertson of the University of Toronto's Citizen Lab put the human side to Wired. Technology, she said, must serve as "the secure operating platform for hospitals, for banks, for national security agencies." She added that police rely on it to protect victims who report private information. The person who reports a crime depends on the protection critics fear would weaken.
Wired notes that the UK and Australia have introduced reforms that can compel companies to break encryption. Proposals have surfaced elsewhere too. Not all have become law. C-22 is one bill, still under consideration. It is not a finished outcome.
What leaders should ask
First, which encrypted messaging, VPN and privacy tools do your staff and customers use? Ask your security team for a list. Note where each vendor operates.
Second, what happens if a vendor leaves a market? Signal and Psiphon say they would. A tool that vanishes from one country can disrupt staff and customers there.
Third, do you hold subscriber data that a Canadian request could reach? That matters if you serve the public. Ask counsel how a foreign request would be handled.
Fourth, who tracks proposed laws like this before they pass? C-22 changed after criticism. A decision based on the first draft can be wrong later.
Critics say a lock that opens for police has a second key. Whatever the outcome, plan for the day your vendors must choose.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Parliament of Canada (House of Commons), Bill C-22 first reading.
