Article Psiphon Vpn Provider Plans To Quit Canada Over Lawful Access Bill

A Canadian company that has created software to help people living under oppressive regimes evade censorship and retain access to the internet says it plans to leave Canada if the federal government’s lawful-access bill passes in its current form.

The lawful-access bill, known as Bill C-22, would require telecoms, internet companies and other electronic service providers to make changes to their systems to give surveillance and monitoring capabilities to police services and the Canadian Security Intelligence Service.

CSIS and law enforcement have long argued that Canada is lagging behind its Five Eyes intelligence partners in not having such a lawful-access regime to aid investigations.

But the bill has provoked a backlash among tech companies with some saying they would quit the country if it becomes law.

Toronto-based Psiphon, which has millions of users worldwide including in Iran, Russia and China, told The Globe and Mail on Friday it has started drawing up plans to move its operations out of Canada. It said the bill would force it to compromise crucial safety features put in place to protect the privacy of its users in authoritarian countries.

Tech, VPN companies call on Ottawa to make more changes to lawful-access bill

Psiphon, whose origins were at the University of Toronto’s Citizen Lab, said it has 20 million monthly users worldwide, and said the use of its software tends to surge when there is a spike in repression. In February, during a crackdown by Tehran against protestors, it had 21 million users in Iran.

The Canadian tech company has 3.5 million users a month in Myanmar, formally Burma, where the military junta has used internet blackouts to cut off communication channels and banned the use of virtual private networks, or VPNs, that encrypt a user’s internet traffic and can disguise the location where they are connecting to the internet from.

Psiphon has devised technologies, including a VPN, to evade censorship, as well as complex routing protocols, using servers located around the world, and other security mechanisms to allow people to access the internet without being tracked. The way the system is designed and the scale of its use makes it difficult for censors to untangle, so it can keep operating if a VPN is blocked by a regime, the company says.

Kenzie Elsworthy, vice-president of Psiphon, said: “We spend our days protecting people from authoritarian surveillance. This bill would compel Psiphon to help build an arbitrary surveillance system in Canada.”

The federal government amended Bill C-22 in the House of Commons before its summer recess to address concerns, including from tech giants Apple Inc. and Meta Platforms Inc., that the bill could compromise cybersecurity and privacy. One such amendment protects end-to-end encryption. The bill is now due to be scrutinized in the Senate.

In an interview with the Toronto Star last month, Public Safety Minister Gary Anandasangaree said he expects the bill to pass in its existing form. He described the current bill as “the right balance,” in which cracking encryption is “off limits” except in rare “extenuating circumstances.”

Major Canadian online privacy company plans to leave country if lawful access bill passes

Last month, tech companies that deliver digital services to Canadians wrote to Mr. Anandasangaree urging further changes to the bill, saying it would force companies to weaken encryption or “build intercept capabilities.”

Among the signatories were companies operating VPNs including Windscribe, a Toronto-based company that has more than 100 million registered users worldwide and has warned it may leave Canada if Bill C-22 becomes law.

Psiphon is different from many software companies providing VPNs and cybersecurity in that its code is public, an “open-source” policy designed to build trust among its users. The lawful-access bill could require tech companies to make changes to their software or systems to allow surveillance, but would have to keep such changes secret.

Ms. Elsworthy said the reason Psiphon’s software is trusted is that anyone can inspect its code, but “the moment we are forced to add a secret capability, that trust is gone, and so is the product.”

“You cannot build a secret backdoor into open-source code. Every line we ship is public. Any access capability this bill forces us to build would be visible to the whole world, including the authoritarian governments our users are trying to escape. That is not lawful access. It is a published vulnerability,” she added in an e-mail.

Ottawa lawful-access bill could be obstacle to EU-Canada digital trade agreement, European privacy groups say

She said there is great uncertainty over which companies would be required to introduce surveillance capabilities, as this would not be defined until after the bill is passed. Psiphon would have to work on the assumption, for business planning, that it would be covered.

“We do not want to leave Canada. We were built here, originally out of the University of Toronto, and we have been here for nearly 20 years. But if this bill passes as written, relocating is the only way the work continues. That is not a choice we would weigh. It is the only option left,” she said.

Psiphon this year received $600,000 in federal government funding from the National Research Council to help improve its network.

Simon Lafortune, a spokesperson for Mr. Anandasangaree, said “the existence of a lawful-access framework does not, on its own, make it impossible to operate a secure, privacy-protective service in Canada.”

“It is also important to note that the fact a company falls under the definition of electronic service provider (ESPs) does not mean that it would be the subject of lawful access obligations under the Act. Most ESPs will not be core providers, nor will they be subject to a Ministerial order,” he said.

He said the government would consider a range of factors, including the nature of the service being provided, the extent to which the service is used in Canada, when considering a company’s lawful-access obligations.

Psiphon was created as a Citizen Lab project in 2006, and spun out as a private company soon afterward. It now operates independently.

U of T professor Ron Deibert, founder and director of the Citizen Lab, said Bill C-22, as now written, “will make it impossible for a large number of invaluable privacy-preserving tools and applications from operating in Canada.”