Encryption Is Getting Squeezed From All Sides

CommentSave StorySave this story CommentSave StorySave this story Welcome to Kernel Panic, a weekly . To receive this in your inbox each week, here. The Great White North is the latest country to contemplate legislation that could essentially mandate backdoors and increase data retention in encrypted services. The proposed changes have prompted the Canadian anti-censorship company Psiphon VPN—which keeps millions of Iranians online during repressive internet shutdowns—to say it will leave the country if the bill passes. And Psiphon is not the only one. Encrypted messaging app Signal has said it would exit the Canadian market because the legislation would require unacceptable changes to its open source projects. Apple and Meta have criticized the bill, and DuckDuckGo and NordVPN say they would consider pulling their services, too. But as countries around the world contemplate similar legislation, even larger questions begin to emerge about which states or regions could differentiate themselves as being safe havens for privacy services if global hostility to encryption continues to rise. Governments already have broad digital surveillance powers and investigative tactics to solve crimes that involve encrypted data, but legislative proposals almost inevitably include provisions to expand this access even more—mandating additional logging and what amounts to backdoors or intentional flaws in encrypted products, which cryptographers and security engineers have consistently said cannot be built safely. Truly everyone who understands the issue has said it as much for decades. Other encryption-threatening proposals have also emerged in the EU, France, India, Ireland, Spain, Sweden, Switzerland, and others. While not all measures have passed into law or been enacted, the hostility is clear. “Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption,” members of the US House Judiciary and Foreign Affairs committee said in a May letter to Canadian officials. In addition to potential impacts on encryption, C-22 also includes provisions that could require companies to retain metadata about user activity, something that many privacy focused services (including VPN services from Psiphon and DuckDuckGo) intentionally avoid. As a result, these companies say, they would be forced to change their business models to collect data they do not need or want to collect about their users. And researchers say that such product changes would diminish user trust while increasing the potential for widespread surveillance. “If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it,” says Afsaneh Rigot, the founder of the De|Center, a research organization that aims to reduce the risk of technological harms. “There are contexts like Iran and other contexts globally, who all of this has a trickle effect on.