A Toronto-based privacy tool used by millions of people living under censorship regimes says it may have to abandon Canada entirely. Psiphon has told The Globe and Mail it is drawing up contingency plans to relocate its operations if Bill C-22, the federal government's lawful access legislation, becomes law in its current form. The company argues the bill would force it to weaken the very protections that keep users in Iran, Russia, and China safe from state surveillance.
Psiphon's situation is unusual because it publishes all of its code openly, a transparency model that many privacy-conscious users rely on when deciding which circumvention tools to trust. For readers unfamiliar with how these systems work, resources offering step-by-step setup instructions can clarify how open-source privacy software differs from closed, proprietary alternatives - and why that openness matters so much to the people depending on Psiphon in hostile digital environments. Because the entire codebase is visible to anyone, there is no way to insert a hidden access mechanism without it being immediately discovered by security researchers, journalists, or the authoritarian governments the tool is designed to evade. step-by-step setup instructions
That transparency is precisely what collides with Bill C-22's requirements. The legislation would compel telecoms, internet firms, and other "electronic service providers" to build in surveillance capabilities for police and intelligence services, and in many cases to keep those capabilities secret. Psiphon vice-president Kenzie Elsworthy put the contradiction bluntly: in an open-source system, a hidden back door is not lawful access at all - it is "a published vulnerability," visible to everyone, including the hostile regimes Psiphon's users are trying to avoid.
A Pattern Beyond One Company
Psiphon is not alone. Signal, NordVPN, and Windscribe have all signaled they might withdraw from the Canadian market if the bill passes unchanged. Last month, 23 companies, including Windscribe, Nord Security, and Kape Technologies, parent company of ExpressVPN, jointly urged Ottawa to amend the legislation. Citizen Lab founder Ron Deibert has warned the bill, as drafted, could make it impossible for many essential privacy tools to keep operating inside Canada. For a country that positions itself as a defender of digital rights, that is a reputational problem as much as a technical one.
Why the Legal Uncertainty Matters
Part of what makes Bill C-22 so disruptive is its structure: it does not specify exactly which companies qualify as "electronic service providers" until after the bill becomes law. That leaves VPN providers, encrypted messaging apps, and circumvention tools preparing for worst-case scenarios without knowing whether they will actually be covered. The government amended the bill before it passed the House on June 18, adding safeguards for end-to-end encryption and shortening mandatory metadata retention from a year to six months. Even so, the core tension remains unresolved: a mandate for lawful access sits awkwardly alongside tools whose entire purpose is resisting surveillance.
Ottawa's Awkward Position
The funding angle sharpens the irony. Psiphon received roughly $600,000 in National Research Council support this year, meaning Ottawa has effectively subsidized a tool it is now threatening to legislate out of the country. With the bill now before the Senate, and privacy advocates in Europe also raising concerns, lawmakers face a narrowing window to reconcile domestic surveillance ambitions with Canada's international standing on internet freedom and digital rights.
