Welcome to Kernel Panic, the weekly newsletter produced by Lily Hay Newman and Matt Burgess that explores the evolving landscape of privacy and digital security. Readers can sign up to receive it in their inbox each week. Canada has become the latest nation to consider legislation that could effectively force backdoors and extend data‑retention requirements for encrypted services. The draft bill has prompted Psiphon VPN, the anti‑censorship company that keeps millions of Iranians online during internet shutdowns, to say it will leave the country if the measure passes. Signal, the encrypted messaging app, has also announced plans to exit the Canadian market because the proposed law would demand changes that conflict with its open‑source principles. Apple and Meta have voiced criticism, while DuckDuckGo and NordVPN say they are weighing the possibility of pulling their services as well.
As more governments around the world debate similar measures, the question arises whether any state or region can position itself as a safe haven for privacy‑focused services in an environment of growing hostility toward encryption. Democratic nations are increasingly proposing revisions to surveillance and data‑collection laws that would grant police and intelligence agencies broader powers to access personal information. Existing digital‑surveillance powers already enable authorities to investigate crimes involving encrypted data, but new proposals often add requirements for extra logging and what amount to backdoors or intentional weaknesses in encryption products. Cryptographers and security engineers have repeatedly warned that such backdoors cannot be created safely, a point that experts have made for decades. Yet legislators continue to revisit the idea, apparently hoping for a breakthrough that will make it feasible.
“There have always been some officials within certain agencies that tend to view technology as a crime scene in and of itself, and it becomes a myopic point of fixation where access is desired,” said Kate Robertson, senior research associate at the University of Toronto’s Citizen Lab. “But that type of siloed thinking forgets that technology needs to be the secure operating platform for hospitals, for banks, for national security agencies, for police services themselves to protect victims who report private information to them.”
In recent years the United Kingdom and Australia have enacted sweeping surveillance reforms that can compel companies to undermine their own encryption. Similar proposals have surfaced in the European Union, France, India, Ireland, Spain, Sweden, Switzerland and elsewhere. While not every initiative has become law, the trend of hostility toward strong encryption is unmistakable.
Canada’s C‑22 bill, first introduced in 2025 and later revised after fierce criticism from tech firms and civil‑society groups, would allow authorities to require tech companies—whether based inside or outside Canada—to add “technical capabilities” that enable law‑enforcement access to data. Although the bill claims companies would not have to create a systemic vulnerability, critics argue that any capability to read end‑to‑end encrypted data functions as a backdoor that could be discovered and misused. The risk is amplified by the growing availability of AI tools for reverse engineering and system mapping. Members of the U.S. House Judiciary and Foreign Affairs committees wrote to Canadian officials in May, warning that “companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption.”
Beyond encryption, C‑22 also contains provisions that could force companies to retain metadata about user activity, a practice that privacy‑focused services such as Psiphon and DuckDuckGo deliberately avoid. Those firms say the bill would compel them to alter their business models to collect data they neither need nor want, eroding user trust and expanding the scope of surveillance. “If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it,” said Afsaneh Rigot, founder of the De|Center, a research group that works to reduce technological harms. “There are contexts like Iran and other contexts globally, who all of this has a trickle effect on. It’s not going to stay in Canada because these types of laws always get copy‑pasted around the world.”
As more countries contemplate such regulations, developers of privacy and anti‑censorship tools are scouting jurisdictions that might offer protection. Yet relocating headquarters does not solve the problem when laws follow users, as C‑22 would. “Changing your headquarters isn’t much of a plan B when the law follows your users,” said Joseph Lorenzo‑Hall, security portfolio lead at the Internet Society. “The strongest protection is holding as little user data as possible, but ‘we don’t have it’ is no defense if governments can force you to start collecting it. A safe haven needs more than favorable winds in strong encryption. It needs laws that let companies keep their privacy promises and defend them against foreign threats to confidentiality and integrity.”
Spotted something we should include next week? Let us know at [email protected]. Stay safe out there.