Canada’s ambition to build digital sovereignty relies on the security of its systems, which in turn depends on strong encryption. Encryption safeguards financial transactions, personal health data, and government services, making it an essential aspect of trust in digital communications.
As Parliament debates Bill C-22, a principle has emerged: lawful access demands should never require adversaries’ access or prohibit providers from fixing flaws in secure end-to-end encryption. Effective investigations and secure infrastructure are both in the public interest, and Canadians deserve legislation that balances these needs.
Lawful Access and Encryption
Law enforcement and intelligence agencies have a right to investigate serious crime and national security threats. Sometimes digital evidence is essential to that effort. However, requiring access to encrypted content can compromise a service’s security, especially if the provider lacks access to users’ keys.
An authorization does not by itself ensure the feasibility of an access means. Something implemented for a specific investigation may add extra code, credentials or privileges that need to be guarded. This distinction needs to be made as the argument continues, and the security impact of any solution must be considered.
A Canadian organization selecting a secure messaging service to share sensitive work may have to understand how a new requirement to create an alternate access channel increases its own level of exposure. This concern remains, whether the organization is a business, community group, or public institution.
Technical Review and Implementation
Technical review of any solution must be conducted over the whole system, considering whether implementation impacts other users, generates reusable functionality, or reveals information outside the scope of the investigation. Bill C-22 should be debated with these considerations in mind, and the amended proposal should be weighed against the legislation, regulations, and technical effects of implementation.
Encryption Security Concerns
On October 8, Mozilla warned that the proposed framework could still weaken encryption and security, highlighting ongoing disputes over the extent of the powers being considered. Earlier, the Privacy Commissioner conditionally supported an improved version of the previous proposal, advocating for stronger safeguards regarding proportionality, encryption, and systemic risks.
The government asserts that the revised framework includes protections, such as a provision against compelled decryption in certain cases. Nonetheless, public discussion should focus on the amended proposal, and its guarantees must be weighed against legislative and technical implementation impacts.
As of October 12, Bill C-22 is undergoing second reading in the Senate, with debates from October 8 on record. The Linux Association of Canada supports a thorough, fact-based debate, open to public scrutiny and adhering to proper procedural standards. Parliament should seek independent technical evidence to ensure the protections are clear and practical.
Read Also: Gen Z makes up 38% of Canadian small business staff
Digital Sovereignty Risks
Canadian ownership of data hosted domestically does not shield it from software flaws, compromised credentials, or privilege-related risks. Digital sovereignty entails organizations using and defending infrastructure under accountable governments. Canada must safeguard the security foundations of the digital tools institutions rely on.
Open-source software might assist via transparent code, shared standards, and the potential for a system to be maintained or modified by oneself. However, those benefits require continued maintenance, expertise, and responsible security practices. A public repository alone does not ensure safety, and investigators and operators need to be able to look into problems, work together on responsible disclosure, and fix them.
Laws should enable that. Secrecy obligations for investigations require formal channels for technical review, oversight and remediation. In Canada, that means there is a need for people who can evaluate such issues: security researchers, Linux administrators, software maintainers and folks with an understanding of cryptography and infrastructure.
Building Canadian Expertise
Developing this expertise is integral to building sovereignty. Smaller Canadian providers may particularly benefit from access to review and the opportunity to raise concerns before changes are implemented. A complex compliance framework could undermine another Canadian priority: a lively, diverse homegrown tech industry.
Parliament should assess whether mandates are proportional to the service and whether recipients can implement them securely. Security standards must be rigorous, yet the review process should be accessible to various organizations. An accountable lawful-access system requires binding technical limits and a process for providers to flag unsafe requirements before implementation.
Laws should be defined by what is necessary and proportionate in relation to data collection, retention, or disclosure. The retention and collection of more sensitive data impose additional security obligations and consequences when data is compromised. Every obligation should have a rational purpose, scope, and limit, and public reporting can be used to answer questions while still protecting the particulars of individual probes.
Canadians should be able to evaluate whether the regime preserves their safety and their rights, and the review process must consider things that happen once the software is deployed, including software updates, emerging attack methods, and invalidated assumptions from an initial review.
Technical Limits and Vulnerabilities
Providers should be able to raise concerns about unsafe requirements prior to implementation, with expert review to ensure that the measures are proportionate to the service. The review process should be accessible to a range of organizations, including smaller Canadian providers, to ensure that they can comply with the regulations without compromising security.