Google has told Canadian lawmakers that Bill C-22 would build a “surveillance infrastructure” that weakens cybersecurity for everyone.
The company’s submission to the House of Commons public safety committee landed alongside a blunt refusal from Swiss-based Proton VPN and a trade warning from the Information Technology Industry Council, a US lobby group representing Amazon, Google, and Nvidia.
Bill C-22 would force telecoms, messaging apps, and potentially any digital service in Canada to rebuild their systems for police and CSIS surveillance, while storing user metadata for up to a year.
That metadata covers who contacted whom, when, and from where, for millions of people not suspected of anything.
Reclaim Your Digital Freedom.
Get unfiltered coverage of surveillance, censorship, and the technology threatening your civil liberties.
Even Google, which is ironically no stranger to surveillance accusations, warned that the bill gives the Public Safety Minister “sweeping powers to issue secret orders” to intercept data, and that its definition of “electronic service provider” could catch nearly any company operating in Canada.
The company called the bill’s safeguard against systemic vulnerabilities dangerously narrow. “Without a stronger definition of ‘systemic vulnerability,’ the law could be used to decrease overall user security, by creating backdoors that would break end-to-end encryption and create significant cybersecurity risks, facilitating foreign interference and weakening global user privacy,” Google wrote.
The company added: “Google has never built a backdoor or other mechanism to circumvent end-to-end encryption in our products. If we say a product is end-to-end encrypted, it is end-to-end encrypted.”
Google joins Apple, Meta, and Signal, the last of which has threatened to leave Canada entirely rather than comply.
Proton VPN’s general manager David Peterson was less diplomatic. “Complying with foreign surveillance orders without Swiss legal process is a criminal offence. Not happening,” he posted on X.
“We’ll defend our Canadian users and never compromise them. We will fight C-22’s application by every means available.” Proton also noted that the EU’s highest court has struck down this kind of mass retention legislation twice already.
The ITI submission added trade pressure, arguing C-22 would have “extraterritorial reach and increase conflict of law issues for global technology companies.”
US congressional committee chairs Jim Jordan and Brian Mast already warned Anandasangaree that American companies face an impossible choice between “compromising the security of their entire user base, including US citizens, or risking exclusion from the Canadian market.”
The government’s own defense of the bill mostly proved the opposition’s point. RCMP officials said retained metadata could identify people “on the scene or at least individuals who were in proximity” to a shooting.
You may remember, Public Safety Minister Anandasangaree has accused tech companies of “misinterpreting” the bill. The companies are interpreting it just fine. They’re reading what it says and refusing to build what it demands.
