Encrypted messaging service Signal threatens Canadian exit amid controversial surveillance legislation
The encrypted messaging platform may withdraw operations from Canada rather than adhere to Bill C-22's requirements, which critics warn could undermine end-to-end encryption security.
The secure messaging platform Signal has indicated it could cease operations in Canada rather than comply with a proposed lawful access legislation that would mandate companies to implement technical surveillance infrastructure, which critics contend could undermine end-to-end encryption protections.
During a discussion with The Globe and Mail, a Canadian media publication, on Thursday, Udbhav Tiwari, Signal's vice president of strategy and global affairs, contended that the proposed legislation poses risks to encryption technology and could expose private messaging platforms to heightened cybersecurity threats.
The legislative proposal known as Bill C-22 forms part of a comprehensive regulatory framework unveiled in March. The bill would mandate electronic service providers to implement surveillance infrastructure and maintain specific user metadata records for periods extending up to one year, representing a broader initiative aimed at assisting law enforcement agencies in investigating serious criminal activities including terrorism and child exploitation offenses.
Critics have raised objections to the proposed legislation due to its ramifications for individual privacy rights, with concerns mirroring those surrounding the European Union's disputed chat control initiative, which presented challenges to encryption by advocating for client-side scanning mechanisms of private communications.
Through a post on X on Thursday, Jacob Mantle, a Member of Parliament representing the Canadian Conservative Party, asserted that "every member of Parliament in the country" relies on Signal predominantly for its security and privacy capabilities, contending that the proposed legislation would create a contradiction by enabling government access to all users' communications.
According to Tiwari, the company "would rather pull out of the country" than adhere to the legislation and undermine the "privacy promises" the platform has committed to its user base.
Bill C-22 could potentially allow hackers to exploit these very vulnerabilities engineered into electronic systems, with private messaging services serving as an ideal target for foreign adversaries.
The proposed legislation has not yet been enacted into law, as it must complete parliamentary scrutiny and obtain royal assent before implementation. Committee examinations commenced on May 7 and continue to be underway.
Major technology corporations including Meta have expressed support for particular components of the proposed legislation, observing that it would "provide law enforcement with an effective legal framework to obtain critical evidence and protect public safety," though simultaneously expressing reservations that specific provisions adversely impact "Canadians' privacy and cybersecurity."
Signal is not alone among companies experiencing concerns regarding the proposed regulatory framework. In a post on X on Thursday in response to The Globe and Mail coverage, VPN service provider Windscribe indicated it would follow Signal's lead in exiting Canada, maintaining that the legislation represents a danger to user privacy protections.
"We won't be far behind if C-22 passes. In its current state, VPNs would almost certainly require us to log identifying user data," Windscribe said.
"Signal isn't headquartered in Canada so they can just shut off Canadian servers, but our HQ is. We pay an ungodly amount of taxes to this corrupt government, and in return they want to destroy the entire essence of our service to basically spy on its own citizens," Windscribe added.
Cointelegraph reached out to Signal for comment and will update the article if the company responds.