Tech firms urge Canada to amend Bill C-22 before it becomes law

A coalition of technology companies, VPN providers and digital rights groups is urging Canada to amend Bill C-22, the proposed Lawful Access Act, before it becomes law. The bill would give law enforcement and intelligence agencies broader access to digital information during investigations.

In an open letter organized by the Chamber of Progress, signatories including Windscribe, NordVPN and ExpressVPN say the bill’s encryption and data-retention provisions could weaken privacy and cybersecurity. They object in particular to the bill’s unresolved definition of a “core provider,” which they say could leave services subject to secret orders to change their security systems.

The letter warns that requiring companies to weaken encryption could expose users to risks from criminals and foreign adversaries. It also says some firms have already indicated they would leave Canada if the bill passes in its current form. Windscribe CEO Yegor Sak has discussed options for moving the company’s headquarters abroad, and told TechRadar that the bill makes Canada an untenable place for many technology companies to operate.

TechRadar reports that companies could face requirements to retain user metadata for up to six months. The Canadian government has said it will amend the bill’s encryption and metadata rules. Public Safety Minister Gary Anandasangaree has nevertheless said the core of the legislation “needs to happen.”