Signal has once again stated it will not make changes to its app to comply with Canada’s Bill C-22 (the Lawful Access Act) – and would rather leave the country than do that.
Proton, the Swiss privacy company, has also made its position clear: it will not accept the bill’s metadata rules, and has already dropped the idea of making Canada the home of its North American headquarters.
Proton’s chief technology officer Bart Butler was blunt: “Any sort of extended metadata requirements beyond what we’re obligated to do as a Swiss company would be probably a no-go for us from a compliance standpoint.”
The bill was passed in the House of Commons on June 18 and is now in the Senate, where it had its second reading debate on October 8. It remains there.
In June, the country’s Public Safety Minister Gary Anandasangaree added some amendments to the proposed law, in an attempt to make it more palatable to privacy and rights advocates and companies that would be affected by its provisions.
One of the amendments was to make sure that a company that does not hold the key to its encrypted data would not have to decrypt it. Another was to limit the amount of time internet and phone companies can be made to keep metadata – from a year to six months.
The minister’s spokesman Simon Lafortune says that the legislation “explicitly states that it does not require the decryption of end-to-end encrypted information and does not permit or compel companies to introduce systemic vulnerabilities or so-called ‘backdoors’.”
However, Signal is not convinced. On October 5, its vice-president of strategy and global affairs Udbhav Tiwari spoke at an Ottawa panel organized by the Canadian arm of the Internet Society, and the session was recorded for Senate committees.
Tiwari said the amendments still allow for ministerial orders “that can be ruinous for encryption and privacy for all Canadians.” Signal could still be forced to make changes to its software “that negates the very purpose of encryption itself – and that is something that is a very strong red line.”
Tiwari explained that this week, Signal stores only a phone number, the date an account was created, and the last time it connected.
If Canada were to demand that it start storing metadata, “For us this is a serious enough issue that it would fundamentally break Signal,” Tiwari said.
Given the choice of “creating a much weaker version of our product that collects all of this metadata, the choice for us, unfortunately, would be starkly clear: we will not make changes to our product – which is open source and available for anyone to verify – to comply with such demands that place the privacy of not just Canadians but everyone else in the world at risk.”
Mozilla, another tech company that was at the Ottawa event, is also unhappy with the bill. Christian Sadilek, a senior principal software engineer, said that the bill could force companies to build weak points into their products, which AI tools can now quickly discover, “which can autonomously scan vulnerabilities, detect them, and find ways to break in.”
He also explained that metadata can be very revealing, and give away “almost every detail about a user,” including their religion and “what diseases they are struggling with.”
Butler told The Globe and Mail on October 21 that the planned expansion into Canada, with a North American headquarters there, is now off.
He added that “we would not pull out of Canada in the sense that we would not stop offering services in Canada, but we would certainly not expand in Canada, hire in Canada, do other things.”
“As democratic as Canada remains today, I think it’s also fairly naive to expect that the good guys will always be in power,” he said.
Meanwhile in the Senate, the bill’s sponsor, Baltej Dhillon, has told fellow senators that “Bill C-22 does not authorize mass surveillance” – and said he avoids the phrase backdoor access “because it alludes to a whole bunch of different things that are not true.”
Senator Paula Simons, however, said the bill would allow the government to make providers keep “the metadata of all their Canadian customers for six months just in case the police should ever have cause to look something up.”
This, she said, is a heavy burden, “especially for companies such as Signal, which retain little or no metadata now, or only retain it for a few days or hours.”
In May, Signal’s Tiwari said that the company would “rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users.”
Even the June amendment to C-22 that is supposed to protect end-to-end encryption by saying that companies that do not have the key to unscramble data will not be forced to decrypt it actually leaves the door open to achieving the same via metadata.
In the case of Signal, this means that even if the app does not hand over the content of messages, the authorities could get information about who the user communicated with, when, and from where. And this is information that Signal does not currently collect.
