https://action.openmedia.org/page/188754/
Here's the one I went through..
(Edit) wrong link, I fixed it
this post was submitted on 18 May 2026
148 points (100.0% liked)
CanadaPolitics
3291 readers
54 users here now
Placeholder for any r/CanadaPolitics refugees
Rules
- Keep the original title when submitting an article. You can put your own commentary in the body of the post or in the comment section.
- Has to be relevant to Canadian politics.
Reminder that the rules for lemmy.ca also apply here. See the sidebar on the homepage: lemmy.ca
founded 3 years ago
MODERATORS
I can't insist enough on how bad this is. Putting at risk all messenging systems, it would be only a matter of time before a malevolent actor get the keys and get all kind of personal and sensitive data.
top 21 comments
sorted by:
hot
top
controversial
new
old
Thanks for posting the link for those who don’t want to scroll and read a lengthy blog post. Good information but if you want to quickly jump to the “mail my MP”, click the link above.
'Blowing the CIA and Palantir surely woln't come back to bite me' the politician thinks before having an intern post an 'elbows up' meme
We got a link for a petition?
They recommend you email your mp in this section: https://dontsurveil.me/c22.html#act. It doesn't take too long
What is the impact with tools like Signal in Canada
Signal would have to get a copy of user's private keys, and a history of the messages for one year.
You can imagine all that could go wrong with that: example: breach in their server. Today that would yield a list of phone numbers and... that's pretty much it. After the bill is effective: one year of all communications from all canadians users. That's assuming they put in the resources to offer separate clients for Canada and the rest of the world, add the internal infra to support data collection, and geographically constrain who can download which client.
They already warned they wouldn't do that, as it would severely compromise the security of their app, defeating its purpose, and most likely excessively strain their resources. Therefore the law would force them to depart Canada, and geographically block their app's downloading here.
God did something amazing when he didn't exist and we evolved. We got a middle finger!
Normally you use it for graving things or to curl around when you're pointing with the pointing finger. But one cool thing you can do is flip it at officials to symbolize a penis.
So the legislation specifically excludes 'personal' content, and doesn't require direct paths to data / back doors for law enforcement. This is doomerism hyperbole.
It requires that companies store meta data for a year, so that it can get accessed by law enforcement, and it establishes that law enforcement can ask if 'so and so' is a customer of tech companies, so that law enforcement can then go get a warrant from a judge to access details about that customer. In storing that metadata, the legislation says the specific requirements of what metadata to store would be decided by regulators of industries.
In terms of privacy protection, requiring companies to keep meta data log files isn't a bad thing in itself. Consider a 'log less' service where you've provided some details to get an account going -- or even something you pay for, like a VPN service, which has some payment info from you. If they got hacked, and all your payment data was taken, then your credit cards are exposed and there's a real/material risk of harm to you.... but they didn't keep any logs of any of the hacking event because they're a 'log less' company... do they even know if they got hacked? Can anyone prove they got hacked? Is there any evidence trail available leading to those hackers / tying them to the breach? I've heard guys working in fintechs say "Why would we keep logs -- they're just evidence for when we screw up". Arguably, by not monitoring for this sort of thing / tracking meta data, you expose customers to greater risks, because you are not monitoring who's accessing the personal data -- so anyone could be accessing it, even now.
Especially in the case of foreign services, with laws in foreign jurisdictions that establish their governments can look at whatever they want, even beyond the meta data, without the company being able to disclose that to others (side note, c-22 seems to put a limit of 1 year on muzzling disclosures -- so a privacy oriented company could automate the transparency and inform customers of both requests for their personal metadata, as well as provide an aggregate report of 'last years' requests from govt). But in terms of clandestine/outside legal purview stuff, consider the stuff being done in the states with DHS/Ice, and the Patriot Act. Even if that foreign service, which routes all your messages, is mirroring your messages off to a law enforcement portal for someone like the CIA -- they don't have to log themselves doing it, and would have no obligation to tell you they're doing it, and if you tried to ask for the meta data about how your messages are routed, or who'd accessed your account, they could fall back on the logless setup as an excuse for having nothing to show you.
Getting back to that first case, with the specific companies and logs -- a semi important note is that right now, there aren't really set requirements/standards for how log files are handled by companies. So a company can set a retention period for their granular logs at like 7 days or whatever they want. And most likely everyone understands that retaining log data costs money for storage devices, and that companies often aim for the cheapest options they can get away with. So even if ppl are trying to blast headlines about specific 'log less' services that are saying they may leave, they should also be thinking about "How long would a company like Telus, Bell and/or Rogers willingly pay to store log information for the purposes of investigations / tracking crimes being committed using their services? How about banks, doctors offices, and other critical service providers that hold tons of our personal information?". Same with general ISPs. Like if some ISP is hosting a kiddie porn site, yeah, I think the cops should be allowed to demand at least 1 year worth of meta data to see who connected to that kiddie porn site. That seems reasonable to me, especially if the main (non-meta) data is still behind a warrant/judicial review.
This is the government rebuttal. It goes against Signal, Apple, Meta, even US gov agencies (as communication between Canada and US could be compromised), and more independent reviewers, ALL of them saying the requirements put in the law will make the communication systems vulnerable.
But sure: they are ALL misunderstanding the law.
Hyperbole doomerism also when Apple warned the UK about their impossible requirements to be able to access encrypted cloud storage content without compromising security. "They'll manage!". Manage they did: Apple has now disabled encryption of the online storage content for UK users.
It takes a certain mindset to be that confident, to the point you can claim all experts in a field are wrong, we, small group of lawmakers, know better!
Show me the line in the current version of the legislation that says organisations need to create back doors for law enforcement.
There's literally pre-defined forms in the legislation, and companies get to challenge those forms / requests for up to 10 business days, and so on. And user content is explicitly exempted. That doesn't really sound like "An automated backdoor to all your data!"
The data sought is largely oriented around meta data, and data the companies have access to. So, like if you have a company that does private/secure cloud backups, you'd provide the cops with confirmation that so and so is a client. They'd then go get a warrant. You'd then provide them with the encrypted blob of data. Since you don't have the private keys to unlock that data, you can't provide that, nor are you required to by the legislation.
Companies freaking out about this just don't want to be accountable, nor do they want to have any added costs/obligations to police/moderate their services.
And who the fuck would side with the USA's tech oligarchs, and the US facist government at this point? Hell, the fact that Meta's crying should be a sign that we're on the right track. Mark's gotta expose all those bots and faceless influencer sorts that are trying to amplify Alberta separatism, when requested to do so by Canadian law enforcement / judicial review etc. Boo hoo. These twats clearly can't regulate themselves. Like seriously, you're whining to Canada that US companies are complaining about the legislation -- even though those same US companies are actively cooperating with the US government to integrate their data holdings into US AI surveillance shit. Rubio literally pushed a memo last year saying to fight against any attempts at data sovereignty outside the US, cause having their ability to covertly spy on everyone's data clipped would be a "national security risk". At least try to list a bunch of big Canadian companies that are concerned about the legislation....
Still missing the point. Signal doesn't do data collection and warned that law would make them leave. Definitely a good sign from oligarchs.
As for big techs, we know they already collect all of those data. They're not concerned about privacy, they're concerned about leaks.
If you want data sovereinty, start by banning the use of oligarch tech by the government. This is definitely not what this law is about. It won't reduce the spying by one bit. It wild allow more agents to enjoy the feast.
Ah, yes, you want a Canadian company in the loop. I could offer you Shopify, whose CEO called the bill stupid and warned it would have dramatic impacts on Canada's tech sector's viability. But that's another big data collecting business. How about VPNs fucking out?
You can find similar standings from NordVPN and Proton: applying C22 would have them in violations of the EU and Switzerland laws, so: they would leave.
The good news is even lawmakers are one step ahead of you and agreed today to revise their text following the backlash. The less good news is they're not dropping the whole thing.
Shopify, the company that recently listed a US headquarters in 2025, and is highly entangled in US regulations/ecosystems? That's the one you want to go with here? Windscribe is valid, but it's not exactly a big business / employer of a bunch of Canadians / generator of productivity. As for big tech being concerned about leaks -- horseshit. They're only concerned about money, and this would add a cost.
As for the backlash, it's fuelled by US interests, and lots of foreign company meddling. "This will harm the Canadian tech sectors viability, by not allowing us Tech Oligarchs to have complete freedom to do whatever the fuck we want without government scrutiny. Canada should emulate the USA, where tech oligarchs are explicitly pushing technofascism, are often employed as social security-net destroying "efficiency" czars, and are overtly supporting the Republican administrations efforts to achieve authoritarian objectives. That's a more viable/friendly setup for tech oligarchs to function in, one where they dont need to follow any rules, and can instead just bribe officials using crypto-scam-currencies". Not exactly a reason for me to support those tech company's positions. How bout we set the legislation up to benefit Canadians and Canada's interests, and if foreign companies don't like it, we get Canadian companies that will comply with our laws to provide service instead. Carney and the govt likes to tout how educated Canada's population is -- so use that.
Shopify...
So, not a company that's big, and not a company that's small. With that of course, no adequate company complained...
"We wont' let techs oligarchs spy on us! We will do it at government level! (and still let big tech do it, that will show them!)"
Right now, we're not setting legislation to the benefits of Canadians. We're right on the authoritarian track. Not because it's done by the government rather than big tech is it better!
In case you missed it: US big tech did not say they would leave. They don't need to. What they say is beyond that point, security of the data they have on us will be compromised. We provide them with a perfect excuse for data breaches to come. That's owning them big time! Ahah, we got you: now you have to LOWER your security. Look how we take back our sovereinty!
The companies that are set to leave are the ones offering privacy tools, that benefits Canadians and helps protect them from big techs. They say beyond this step, your privacy is not guaranteed, therefore our tools are useless and we refuse to pretend otherwise" That should also own US big tech! VPNs leaving, that's another big win for Canada!
Next we'll set mandatory cameras on TV so that law enforcement can get records of people at home, to protect women and children from violent men, of course. If that saves some, that's a win, right? And that will own Netflix and Amazon!
Next we’ll set mandatory cameras on TV so that law enforcement can get records of people at home
This is the same ridiculous style of argument used by ultra-right wing nut jobs -- "Trans RIghts?!?! Next they're going to force gender reassignment on us all and take our dicks!!!"
American big tech companies are ones that are opposed to this type of legislation, because it gives the government more control and ability to regulate/dictate terms to those companies, and because ANY regulation will cost them money to comply with. It is the sort of legislation that moves towards digital sovereignty, in that your government representatives are able to set laws/regulations that must be followed. It's an incremental step to put more distance between Canadian tech and US tech, because Canada's so integrated that it's not something that can be 'turned off' like a switch.
I hold Shopify as an invalid example, because it's got significant ties to the USA and US Tech giants. If a huge part of your business is based outside of Canada, and you are beholden to US legislation/regulations that basically say "You can fuck Canada", then I don't care if that business has an origin story in Canada -- they changed teams, very explicitly.
I don't see the standard companies, and the ones who'd theoretically be most impacted by this stuff, in the headlines -- Rogers, Bell, Telus, Quebecor. A big chunk of the legislation is specifically targeted at Telcos, but they're seemingly shrugging at it. I don't see any of the banks/financial institutions, caring all that much. Basically none of the normally regulated industries are lobbying against this stuff, even though it impacts them. Just foreign, unregulated, US tech giant-oriented companies, and one or two tiny VPNs that like to provide a service with zero accountability.
You seem so quick to dismiss things that you don't even read what the legislation is calling for -- people blindly accept the noise generated by US tech and right-wing controlled media, you blast out that message ad nauseam and convince a bunch of privacy idiots to sign petitions before they even realise what the legislation is talking about / looking to do, or why. Thats the sort of person who'd likely vote separatist in Alberta, just because they'd seen it suggested on TV/media enough.
And people still have options for privacy, despite what people claim. Something like Signal does Peer to Peer chats 'privately' by 'helping' people exchange PGP keys. You can exchange PGP keys in regular email clients fairly easily, and generally if you're the sort that's gonzo about privacy you should likely have done that already -- as, as noted, the lack of logs and meta data means you don't actually know if signal, which hosts a bunch of its services in US cloud service providers, is being forced to hand over data to the US anyhow, or if the CSP that they're on is doing the same from deeper in the stack.
This is the same ridiculous style of argument used by ultra-right wing nut jobs – “Trans RIghts!!! Next they’re going to force gender reassignment on us all and take our dicks!!!”
Funny to mention ultra-right from someone defending an authoritarian bill.
American big tech companies are ones that are opposed to this type of legislation, because it gives the government more control and ability to regulate/dictate terms to those companies, and because ANY regulation will cost them money to comply with.
There is jackshit in the bill about terms to these companies other than an obligation to disclose data upon request in a timely manner.
It is the sort of legislation that moves towards digital sovereignty, in that your government representatives are able to set laws/regulations that must be followed.
Spying more on citizens does not move you a mm towards sovereignty.
It’s an incremental step to put more distance between Canadian tech and US tech, because Canada’s so integrated that it’s not something that can be ‘turned off’ like a switch.
There is jackshit in the bill about favoring Canada tech over US tech. It's all about getting data from whichever company operates in Canada.
I hold Shopify as an invalid example, because it’s got significant ties to the USA and US Tech giants. If a huge part of your business is based outside of Canada, and you are beholden to US legislation/regulations that basically say “You can fuck Canada”, then I don’t care if that business has an origin story in Canada – they changed teams, very explicitly.
There is jackshit in the bill that will prevent them to keep fucking Canada.
don’t see the standard companies, and the ones who’d theoretically be most impacted by this stuff, in the headlines – Rogers, Bell, Telus, Quebecor. A big chunk of the legislation is specifically targeted at Telcos, but they’re seemingly shrugging at it. I don’t see any of the banks/financial institutions, caring all that much. Basically none of the normally regulated industries are lobbying against this stuff, even though it impacts them.
Yes, you mean the companies that already keep logs on everything and from which we already see regular data breaches, proving my point about the security concern. Thank you for helping proving my point.
Just foreign, unregulated, US tech giant-oriented companies, and one or two tiny VPNs that like to provide a service with zero accountability.
Yes, they have 0 accountability and that's the very exact reason they complain against a law that does not have anything about accountability and everything about giving up data on their users. It makes so much sense now…
You seem so quick to dismiss things that you don’t even read what the legislation is calling for
Based on what you write it's absolutely clear you haven't read it. You hallucinate what it's supposed to do…
people blindly accept the noise generated by US tech and right-wing controlled media, you blast out that message ad nauseam and convince a bunch of privacy idiots to sign petitions before they even realise what the legislation is talking about / looking to do, or why.
Right wing nuts job like the EFF and privacy activists in Canada. Right… As for the legislation, given all the BS you write, don't pretend you read it, at this stage it would be embarrassing.
Thats the sort of person who’d likely vote separatist in Alberta, just because they’d seen it suggested on TV/media enough.
Hmm… is that projection?
And people still have options for privacy, despite what people claim. Something like Signal does Peer to Peer chats ‘privately’ by ‘helping’ people exchange PGP keys.
Signal is a peer-to-peer system now? That's new… Or… no, it's not!
Peer-to-peer means there is no central server, devices communicate directly to each other.
Signal uses a centralized system. If you mean end-to-end encryption, yes, they do. E2E means the data go through their server but even if they were trying to intercept them, they wouldn't be able to decipher it.
What's left is metadata: who talks to whom, when, for how long, how much data they exchange, etc. Their policy is "don't keep it so you can't give it up or lose it in a breach". Signal was audited by third party confirming they don't keep metadata. They can still be submitted to an injunction to monitor a user by law, and yes they would have to obey it.
Under bill C22, they need to keep metadata, and they need an option to have a backdoor in the app, and they're forbidden to let users know about it.
Signal explicitly said they would have no choice but to end its services in Canada.
You picked the best possible example to prove yourself wrong.
You can exchange PGP keys in regular email clients fairly easily
It's not that easy to lambda users.
if you’re the sort that’s gonzo about privacy you should likely have done that already
Just like the rest, I would say that's none of anyone fucking business but me and the people I communicate with.
the lack of logs and meta data means you don’t actually know if signal, which hosts a bunch of its services in US cloud service providers, is being forced to hand over data to the US anyhow, or if the CSP that they’re on is doing the same from deeper in the stack.
Tell me you don't know what metadata is without telling me you don't know what metadata is. Metadata would tell you jackshit about who's requested what about you. Bill C22 forbids service provider to warn the users about data request, by the way. The only way the US would get these would be to request a real time access to metadata because Signal don't keep them.
Yawn.
"Funny I say blah blah about authoritarian bill" -- yet you don't dispute that your approach to arguing was as disingenuous and absurd as the right-wing example I compared you to. And your subsequent reply to the rest is just riddled with insults, intentional misinterpretations of what I'd said, and attempts to misdirect instead of address my comments directly (for the most part). So I guess that you're just a troll, yes? Should I even bother engaging more with anything else? That's... feeding the troll I believe. I've been baited enough to know its not worth the bother :)
Hold on - you think that not logging VPN activity is the same as not logging access to servers storing credit card numbers?
I honestly stopped reading after that
Logs are logs. PCI has some structure to it, but it's not generally enforced. Hell, we've had cases in Canada where businesses have stored customer credit card information on Excel sheets -- NCIX in BC did this, it came to light after they sold their servers, unwiped, at auction and the new owners got the docs. There are no specific laws that say how a business needs to handle logging to servers holding credit card numbers -- there's just a PCI standard, set generally by a foreign bank consortium, which most/many small businesses ignore.
A log of someone connecting up to something like a customer portal to review their payment information/details, and basic customer information, would fall under the pending legislation. It'd also constitute 'logging' for a log-less company, generally speaking, as it's recording access to that company's services. One reason log-less companies are opposing the legislation, is that it requires them to know who their customers are, and who logs in to use their services, to record some meta data about that usage, and to report that information to the authorities when required.