Psiphon, a VPN provider based in Toronto, is making plans to move out of Canada if the government passes Bill C-22 without any amendments. Psiphon is concerned that the proposed legislation may undermine the privacy protections available to its customers.
The situation arises from the lawful access legislation applicable to electronic service providers. Psiphon is worried that the requirements will lead to modifications in its infrastructure. Also, it may pose a threat to individuals who use its technologies to overcome various online restrictions.
Psiphon raises concerns over proposed surveillance rules
Psiphon was created in 2006 as a project at the Citizen Lab of the University of Toronto, and afterward it became independent and developed into a company serving millions of users. The firm allows users to access different blocked websites and services. To do it, it uses several technologies at the same time: VPN, routing, and different remote servers.
However, Bill C-22 has raised concerns about how services like Psiphon would operate in Canada. The proposed law would establish rules requiring certain electronic service providers to maintain technical capabilities that support lawful access by police and the Canadian Security Intelligence Service (CSIS).
The proposed police powers have also raised broader privacy concerns, as discussed in Canada’s Bill C-22: new police powers raise privacy alarms. The government says these measures would help authorities obtain information under existing legal powers. The government says the bill would not create new powers to access private information.
Psiphon sees a different risk. The company believes the requirements could affect the way it protects users, especially those living under governments that monitor online activity. Its leadership has warned that even the possibility of compulsory technical changes creates uncertainty about the service’s future.
The company also says it cannot be sure whether authorities would classify it as a provider covered by the rules. Therefore, it must consider the risk while planning its next steps.
Open-source software creates a difficult choice
The concerns of Psiphon extend beyond legal compliance. The service is open-source, which allows researchers and the public access to scrutinize its code. Such transparency provides people with an opportunity to evaluate how the software operates – they will know whether their privacy may be at risk.
Psiphon argues that surveillance capabilities may undermine such trust. If the company has to add covert monitoring features, this could ‘dilute’ the protection that users expect from the service. Keeping any such features secret could prove problematic; also, publishing the code could reveal the options to governments that seek to monitor or restrict online activities.
This means the risk is significant because Psiphon serves people who may face censorship or surveillance in their regions. Such users may depend only on Psiphon to have access to blocked information and communicate more freely.
Thus, the company finds itself torn between legal demands and the protection of its mission. Moving outside Canada could become its preferred option if the legislation remains unchanged.
Psiphon is not alone in raising concerns. Toronto-based Windscribe has also opposed Bill C-22 and warned about its potential effects on encryption and privacy. Other technology companies and privacy-focused services, including Apple, Meta, Signal, and Proton VPN, have raised objections to the proposed framework.
In addition, Citizen Lab and the Canadian Civil Liberties Association previously called for changes to key parts of the bill. Their concerns stretch to certain areas, such as surveillance powers, metadata retention, plus possible cybersecurity risks.
Canadian government defends Bill C-22
The Canadian government says the proposed law aims to help investigators obtain information through existing legal processes. Officials argue that service providers would not automatically have to hand over personal information whenever authorities request it.
The government’s explanation states that police and CSIS would still need proper legal authorization to access personal information. Providers would remain in control of their systems and would supply information through secure channels when the law permits access.
Public Safety officials have also argued that most electronic service providers would not qualify as core providers under the framework. They say the rules would depend on factors such as the services a company offers and its use within Canada.
However, the bill would allow the Public Safety Minister to issue orders requiring certain providers to develop capabilities covered by the legislation. The framework would also restrict disclosure of some ministerial orders. Critics worry that this secrecy could make it harder for users to understand what changes a provider must make.
Outcome of the bill may have consequences for Psiphon
Bill C-22 has moved from the House of Commons and is now with the Senate. Its current status means that companies such as Psiphon are contemplating their course of action while legislators deliberate on the issue.
Currently, Psiphon is hinting that it may leave the country but has not confirmed this fact yet. Its decision will hinge on how the bill looks in the end and how the authorities will implement the regulations.
This controversy over the bill also raises a very complex issue related to internet security. Nations need tools that empower them in combating crimes and threats to national security. At the same time, advocates of privacy claim that technical requirements for access might lead to problems unrelated to the intended goals.
In cases where laws force companies to change their structures, they can think about moving their businesses to other regions where the established laws are more in line with their requirements. Such steps can negatively affect jobs in Canada and the high-tech industry in the country. Also, it can raise broader concerns over privacy and faith in digital services in general.
