Canada's status as a stable home for digital privacy engineering was thrown into severe question in October 2026, as major virtual private network (VPN) operators and encrypted communications platforms announced plans to exit the country over pending federal surveillance legislation.
At the center of the controversy is Bill C-22, formally titled the *Lawful Access Act*. Having passed the House of Commons and currently undergoing heated study in the Senate of Canada, the bill seeks to modernize lawful interception authorities by establishing sweeping technical capability mandates. Under Section 14 of the act, any 'electronic service provider' operating within Canadian borders—a definition encompassing internet service providers, VPN networks, hosted proxy servers, and secure messaging applications—must engineer and sustain the technical infrastructure necessary to intercept and deliver unencrypted telecommunications to the Royal Canadian Mounted Police (RCMP) and the Canadian Security Intelligence Service (CSIS).
For privacy networks that operate on zero-knowledge cryptographic models and strict no-logging policies, complying with the mandate is mathematically and architecturally impossible. Building an interception mechanism requires either storing user encryption keys on central servers or engineering backdoors into routing daemons—actions that destroy the fundamental integrity of privacy software.
The University of Toronto's Citizen Lab released an exhaustive legal and technical brief condemning the bill. Citizen Lab researchers warned that state-mandated backdoors cannot be restricted to legitimate law enforcement: once a systematic eavesdropping intercept is engineered into networking software, it inevitably becomes a published vulnerability vulnerable to exploitation by sophisticated nation-state threat actors and criminal extortion cartels.
The corporate fallout has been swift. Toronto-based Psiphon, an internationally recognized anti-censorship and VPN provider used by millions of citizens residing under authoritarian regimes worldwide, publicly stated that it cannot comply with the legislation and will migrate its corporate registration and server fleets out of Canada if Bill C-22 receives Royal Assent in its current form.
While federal public safety officials insist the bill contains safeguards and is essential for investigating transnational cybercrime, the standoff illustrates the growing geopolitical fragmentation of digital privacy, with companies increasingly forced to flee Western democracies that enact mandatory surveillance engineering mandates.