As Signal, VPNs Threaten to Leave Canada, Government Goes into Denial

Signal is threatening to leave Canada over the warrantless wiretapping. The government says critics don’t understand their bill.

Things are quickly unravelling for the government’s credibility over Bill C-22 (Canada’s warrantless wiretapping legislation). Experts and citizens have been decrying the data retention and encryption back door requirements of the legislation. What’s more, the even US lawmakers are saying that the surveillance legislation goes way too far. In response, one Canadian lawmaker released a propaganda video arguing that mass government warrantless wiretapping is a great and wonderful thing and something that totally respects your privacy because, uh, reasons and like such as.

The video alone suggests that the government is hell bent on moving forward with the latest terrible internet bill anyway despite the warnings. As I previously pointed out (and now experts are making the same point, thanks for reading Freezenet!), the government moves are exactly what the government did with the Online News Act and Online Streaming Act.

For the Online Streaming Act, experts warned that it would be open to trade retaliation and would be subject to insane amounts of litigation. In response, rather than take the sound advice from those experts, the Canadian government called for politically motivated “investigations” into anyone daring to criticize the legislation. Creators seeing their careers flashing before their eyes were dismissed as “cat videos” and “not art”. In a final defiant giant middle finger to Canada, the Canadian government passed the legislation because fuck the experts, they don’t know how anything works. Well, as it turns out, the experts were right and the government was sued at least six times over this (arguably causing the CRTC consultation process to get delayed for years). What’s more, the trade retaliation from the US is already happening. In response, the Canadian government is simply trying to not talk about any of this.

While the Online Streaming Act was bad, the Online News Act was even worse. Experts warned that the link tax was going to cause chaos in the news sector. The government, for their part, dismissed the criticisms by those experts. So, in response, experts were dismissed as “shills for Big Tech” and argued that it’s all just a big conspiracy by the likes of Meta and Google to ‘get out of paying their fair share’. This despite their arguments for this bill making absolutely no sense on multiple fronts. Meta warned that they would be pulling news links from their platforms, but those warnings were dismissed as “just a bluff” with some saying that they said that they heard the exact same things in Australia and it worked out in the end. So, in a giant middle finger to Canada (and all logic and reason), the Canadian government passed the legislation, because fuck the experts, they don’t know how anything works. Well, as it turns out, the experts were right and Meta blocked news links in Canada. Despite the mainstream media arguing that they’d come crawling back to work out a deal, that never happened for obvious reasons. Traffic to news sites were gutted, massive layoffs ripped across the news sector, bankruptcies spread like wildfire across the sector, and the largest “news” players were stuck with depending on massive yearly bailouts from the government as they quickly realized that they made themselves completely unprofitable.

Now, we are stuck fighting yet another bad bill – Canada’s warrantless wiretapping bill. After scoring a majority government, the Canadian government immediately got to work pushing warrantless wiretapping through BillC-22, much to the despair of Canadians. Experts raised the alarm about this bill, citing numerous problems throughout. The US warned that this will be problematic with them as well. In a giant middle finger to Canadians, though, the government ignored the experts because fuck the experts, they don’t know anything. We are at this point in history repeating itself. Right now, additional consequences are manifesting.

VPN services are now threatening to leave Canada over this surveillance bill. Specfically, NordVPN and Windscribe. From iPhone in Canada:

Some of the biggest names in the VPN space are telling the federal government to take a hike rather than play ball with new proposed legislation, and it’s shaping up to be a real fight.

Windscribe, based in Toronto, and NordVPN have both come out swinging against Bill C-22, saying it would blow up the privacy protections their entire business is built on. Windscribe didn’t mince words, warning the bill would turn VPNs into the very thing their users are trying to avoid: “In its current state, VPNs would almost certainly require us to log identifying user data.”

Windscribe is actually based in Canada, which means it’s stuck choosing between following the law or getting out. They’ve made it pretty clear which way they’re leaning. “Not happening. We’ll move HQ and take our taxes elsewhere,” the company said on Thursday. “If we start logging our users to comply with this moronic legislation then we might as well shut our doors ourselves. Who wants a privacy VPN that logs its users?” And if the bill passes? “We won’t be far behind if C-22 passes.”

Epic Games CEO Tim Sweeney caught wind of Windscribe’s stance and jumped in with a simple “thanks for defending liberty.”

VPN giant NordVPN also weighed in on Friday. They’re still going through the draft and say they want to be part of the consultation process, but they were clear that their no-logs policy isn’t something they’re willing to budge on. “Should Bill C-22 pass in its current form and if we are subjected to mandatory obligations, there isn’t a scenario in which we would compromise our no-logs architecture or encryption protections.” If it comes down to it, they say they’ll look at “all viable options, including limiting or, if necessary, removing our presence from Canadian jurisdiction.”

VPNs aren’t the only ones threatening to leave Canada, either. Signal has also said that they are going to be leaving Canada altogether as well. In response, the Canadian government is, once again, basically calling this all a bluff or a simple misunderstanding of how great and wonderful their holy bill that shall never be criticized is. From Michael Geist:

Secure messaging service Signal yesterday became the latest company to warn that Bill C-22, the lawful access bill, could force it to leave the Canadian market rather than comply with provisions it says would compromise its end-to-end encryption and create new cybersecurity risks. Signal vice-president Udbhav Tiwari told the Globe and Mail that the company “would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users.” The comments are part of a steady stream of similar warnings from Apple, Meta, the Canadian Chamber of Commerce, the Cybersecurity Advisors Network, and the chairs of the U.S. House Judiciary and Foreign Affairs Committees. Despite growing concern, the government’s response has been to launch a misleading social media campaign and repeatedly insist that the experts and companies are mistaken.

The government’s defence of Bill C-22 follows much the same script. Public Safety Minister Gary Anandasangaree has accused the U.S. tech giants of “misinterpreting” his bill and his department insists the legislation is “encryption-neutral.” When Apple released a statement warning that the bill “could allow the Canadian government to force companies to break encryption by inserting backdoors into their products, something Apple will never do,” officials replied that it “categorically rejected” the claims. When the U.S. House Judiciary and Foreign Affairs chairs wrote that providers of end-to-end encryption “will inevitably face directives to create backdoors and architectural changes that bypass or weaken encryption,” the minister’s spokesperson said the letter reflected “a misunderstanding of how Bill C-22 would function in practice.” When Signal said it would leave, it responded that the concerns regarding installing capabilities to enable surveillance are false. In other words, the government thinks everyone is wrong and the risk of market exits are overblown.

Yet the warnings about Bill C-22 are not idle threats. Apple withdrew its Advanced Data Protection feature from the United Kingdom rather than comply with a Technical Capability Notice ordering it to create access to encrypted iCloud data, and is now litigating the order before the Investigatory Powers Tribunal. Signal previously warned it would leave Sweden over a comparable lawful access proposal, leading to long delays on the Swedish bill (it has still not passed). Given that Signal’s product is end-to-end encryption, compliance with a mandatory access regime would mean ceasing to be the service its users have chosen.

End-to-end encrypted services are among the most privacy-protective communications tools available, regularly used by journalists, lawyers, activists, government officials, and millions of others. If those encrypted messaging services exit the Canadian market because they cannot operate under Bill C-22’s secret ministerial orders, mandated metadata retention requirements, and a poorly defined “systemic vulnerability” carve-out, Canadians lose access to tools the rest of the world will continue to use, while replacement services with less privacy protection fill the gap.

Geist is right to point out how this is the exact same situation as the Online News Act. The players may, in some cases, be different, but the story remains the same. Canadians are going to get screwed over in all of this, but it’s hard to blame the companies for thinking of leaving the country altogether. If you are one of those companies, your choice is either to compromise the privacy and security of your entire userbase or ditch a single medium size country altogether and protect your remaining users. The choice is very obvious, you’re going to leave the country altogether.

The real question is just how many companies will end up leaving. Some are certain to do so, but others are contemplating compromising the security of users to remain in Canada or leaving as well. Obviously, the hope is that the Canadian government would finally listen to reason, but if the last several years are anything to go by, the Canadian government’s track record is absolutely abysmal on that front. It’s why I’m hoping litigation will ultimately settle things instead because major services pulling out of Canada would be a disaster for Canadians.

Drew Wilson on Mastodon, Bluesky and Facebook.