Encryption Is Getting Squeezed from All Sides

Canada is moving forward with a surveillance bill, C-22, that would require tech companies - including those based abroad - to add “technical capabilities” enabling law-enforcement access to data. Privacy-focused services such as Psiphon, Signal, and several VPN and search providers have warned they would leave or change how they operate rather than introduce access mechanisms or store new metadata. Critics note the bill’s carveout against “systemic vulnerabilities” is meaningless in practice: any built-in way to access end-to-end encrypted data creates a backdoor that can be discovered or abused, a risk amplified by modern AI-assisted analysis. The law would also compel retention of metadata that many privacy services currently avoid, forcing business-model changes and eroding user trust.

This Canadian push is one example of a wider international trend - the UK, Australia, parts of the EU and other democracies have floated or enacted measures that pressure encryption and data-minimizing practices. Security researchers and privacy advocates say those moves undermine the integrity of systems relied on by hospitals, banks, and even law enforcement itself. Relocating headquarters offers limited protection if laws follow users; the only robust technical defense is minimizing held data, but legal mandates can force collection. True safe havens, they argue, require legal safeguards that let companies keep privacy promises and resist foreign demands.