Signal Would Rather Quit Canada Than Break Its Own Encryption

By Daniel Rao | October 18, 2026

There is a decent chance the Canadian Parliament is legislating against its own chat history. According to Conservative MP Jacob Mantle, "every member of Parliament in the country" uses Signal — the encrypted messenger — precisely because it keeps their conversations private. And yet Ottawa is pushing ahead with a surveillance bill that Signal says would force it to build the tools to break that privacy. Signal's answer, delivered with unusual bluntness, is that it will simply leave Canada.

It is not bluffing alone. Psiphon, the Toronto-built anti-censorship tool that kept roughly 21 million Iranians online during Tehran's February crackdown on protesters, has told the Globe and Mail it will move its operations out of the country rather than comply. As Wired's Lily Hay Newman and Matt Burgess put it this week: "Oh, Canada."

Photo: Centre Block, Parliament Hill, Ottawa. The Lawful Access Act is currently before a parliamentary committee. Credit: Saffron Blaze / Wikimedia Commons, CC BY-SA 3.0.

What Bill C-22 would actually demand

Bill C-22 — formally An Act respecting lawful access, introduced in March as part of a wider regulatory package — would require electronic service providers: build and maintain technical surveillance capabilities for police and the Canadian Security Intelligence Service, and retain certain user metadata — transmission data, device data, routing data, location data — for up to a year. The stated purpose is modernising law enforcement's ability to investigate terrorism and child exploitation.

Note what is not in the retention provision: message content and browsing history are excluded. But that distinction is doing an enormous amount of work. Metadata — who spoke to whom, when, for how long, from where — is often more revealing than content, and far easier to mine at scale. Committee hearings began on May 7 and are still going, and the bill is reported to have cleared two of its three Commons readings.

In June, Public Safety Minister Gary Anandasangaree tried to take some heat out of the fight, amending the retention requirement down from one year to six months. It did not work. For companies whose entire product is built on not collecting data, any retention mandate is a fundamental redesign — and that is exactly what they are refusing to do.

"We will not make changes to our product"

That refusal came from the top of Signal. Udbhav Tiwari, Signal's vice president of strategy and global affairs, told the Globe and Mail that "creating a much weaker version of our product that collects all of this metadata" was simply not on the table: "We will not make changes to our product."

The bluntness is not posturing; it is arithmetic. As the Freedom of the Press Foundation noted in its October digest, Signal currently retains a user's phone number and two timestamps — account creation and most recent connection. That is it. A six-month metadata dragnet would turn a privacy tool into a surveillance archive.

Tiwari went further, warning that "Bill C-22 could potentially allow hackers to exploit these very vulnerabilities engineered into electronic systems, with private messaging services serving as an ideal target for foreign adversaries." And the company has been consistent about the consequence: Signal "would rather pull out of the country" than compromise the privacy promises it has made to users.

Photo: Signal's Android app, showing the disappearing-messages timer — the metadata-minimal design that C-22's retention rules would force it to abandon. Credit: Signal Technology Foundation / Wikimedia Commons, GNU AGPL.

The timing is grimly comic: October is Cybersecurity Awareness Month, and the Freedom of the Press Foundation opened its October newsletter with a chirpy "Happy Cybersecurity Awareness Month to those who celebrate!" — before warning Canadians the surveillance bill is back. Nothing says awareness like legislating new vulnerabilities in the same month.

The exit list keeps growing

Signal is the loudest name, but the queue behind it is getting long — and notably Canadian.

Psiphon's case is the most uncomfortable for Ottawa. The company grew out of the University of Toronto's Citizen Lab, employs people in Toronto, and serves around 20 million monthly users worldwide — including those 21 million Iranians during February's crackdown and some 3.5 million monthly users in Myanmar. It has started planning to relocate rather than comply, because C-22 would force it to weaken the safety features that protect users in authoritarian countries. As one industry analysis put it: you cannot build a secret backdoor into open-source code, because every line shipped is public. Extra sting: the federal government reportedly gave Psiphon roughly $600,000 in funding in 2026 — the same year its flagship bill pushed the company toward the door. (That figure comes from a single VPN-industry report, so treat it as indicative — but the direction of travel is undisputed.)

Then came the VPNs. Windscribe, whose headquarters are in Canada, responded to the Globe coverage on X with unusual fury: "We won't be far behind if C-22 passes. In its current state, VPNs would almost certainly require us to log identifying user data." DuckDuckGo and NordVPN, Wired reported this week, say they would consider pulling their services too.

Apple has gone further than "consider." In a May statement the iPhone maker warned the bill "could allow the Canadian government to force companies to break encryption by inserting backdoors into their products — something Apple will never do." Google is reported to have warned the committee about "sweeping powers to issue secret orders" mandating interception capacity. Meta split the difference: it welcomed the parts giving police "an effective legal framework to obtain critical evidence and protect public safety," while warning other parts threaten "Canadians' privacy and cybersecurity."

And then there is Mantle. The Conservative MP for York—Durham posted on X on Thursday that every MP in the country uses Signal for its safety and privacy features, arguing the bill would let the government read everyone's messages. We pulled the House of Commons voting records ourselves: Mantle voted Nay on the June 17 proceedings motion for Bill C-22, and he sits on the foreign affairs and international trade committees. The image of parliamentarians voting on a law against the app they all rely on to keep their own conversations private is the kind of detail a novelist would be told to cut for implausibility.

Ottawa says there is no backdoor

The government is not conceding the framing. A spokesman for Minister Anandasangaree says the proposed law "would not require decryption of end-to-end encrypted services" and would not "permit or compel companies to introduce systemic vulnerabilities or so-called 'backdoors.'" The government has "categorically rejected" claims of mass surveillance, and its emailed line is that Canada is the only country among Five Eyes partners, the G7 and the European Union without legislation requiring providers to maintain lawful-access capabilities.

That is technically true and strategically beside the point. Cryptographers have said for decades, with unusual unanimity, that there is no safe way to build a backdoor — a vulnerability engineered for police is a vulnerability available to everyone, including the foreign adversaries Tiwari named. Once the door exists, you do not get to choose who walks through it.

Meanwhile the politics are getting international. Two US congressional committee chairs are reported to have written to Anandasangaree warning that the bill creates "significant cross-border risks to the security and data privacy of Americans." When Washington starts writing letters about your domestic surveillance bill, the file has officially escaped the building.

Canada is not doing this alone — that is the problem

This is the part that should worry anyone who thinks C-22 is a local oddity. The UK and Australia have already enacted sweeping surveillance reforms. The EU's long-running chat-control proposal would push client-side scanning of private messages. Similar proposals are reportedly in play in France, India, Ireland, Spain, Sweden and Switzerland. Encryption, as Wired's newsletter headline had it this week, "is getting squeezed from all sides."

The pattern is familiar: a government cites terrorism and child exploitation — causes no reasonable person opposes — and drafts powers broad enough to reach far beyond them, while each country points to the others as precedent. Canada's contribution is distinctive mainly for its clumsiness: it managed to threaten, in one bill, the app its own MPs use, the anti-censorship tool it funds, and the two most valuable consumer-tech companies on earth. That takes effort.

The verdict: a colossally botched trade

Ottawa's strategy has been shoddy from the start: draft the maximalist version, trim the retention period from twelve months to six as if halving the surveillance makes it principled, and then act surprised when the companies whose products are built on not collecting data refuse to collect data. You cannot keep 21 million Iranians online through a crackdown and then tell their lifeline to start keeping logs. The June amendments did not address a single structural objection — they just made the unacceptable slightly shorter.

Signal has done this dance before, in the UK and elsewhere, and it has never once blinked. The likeliest outcome is not a negotiated settlement but a slow, embarrassing exodus: first the principled apps, then the VPNs, then the quiet degradation of every privacy feature the big platforms offer Canadians — while the mandated metadata sits in databases that make every hacker on earth salivate. If that is modern policing, the price is being paid by everyone except the criminals, who will simply move to tools beyond Ottawa's reach.

The contrast with how Canada talks about tech the rest of the week is striking. Ottawa is simultaneously throwing $500M at AI leadership — the posture of a country that wants to be a trusted tech power. You do not become one by telling Signal, Apple and your own anti-censorship champions to build you a backdoor. California just showed the other direction is possible: Newsom killed America's first smart-glasses privacy law rather than sign a flawed one, and the White House just ended AI self-regulation after it failed. Ottawa should read both before C-22 goes any further.

Sources: Wired's Kernel Panic newsletter (Lily Hay Newman and Matt Burgess, October 17, 2026); Cointelegraph's reporting on Udbhav Tiwari's Globe and Mail interview; the Freedom of the Press Foundation's Digital Security Digest (October 2026); reporting from The Brief, Channel News Australia, Red Hot Singapore and iPhone in Canada on the Apple, Google and Meta positions; and the House of Commons voting record for proceedings on Bill C-22.

Daniel Rao covers privacy, encryption policy and the politics of technology for TechPulse USA. He previously wrote about Canada's $500M AI bet and the global fight over who controls your data.

Update, Oct. 18: the Senate just learned the bill needs years of rule-writing

Bill C-22's path through Parliament produced an awkward admission this week. Writing on October 14, law professor Michael Geist reported that Senate debate had revealed the government expects the first phase of the regulations needed to implement the bill to take "18 months to two years" after Royal Assent — and when Senator Denise Batters, the bill's leading critic, asked whether the remainder might take five years, officials answered: "Yes, probably five years." The subscriber-information powers in Part 1 of the bill would arrive within 180 days regardless; the metadata-retention, technical-capability and equipment obligations in Part 2 depend on regulations that have not yet defined who counts as a core provider, what they must build, or what data they must keep. Geist also flagged a provision letting the Minister of Public Safety impose those same obligations on individual providers by order before any public regulation exists, with disclosure of the orders prohibited by default — though the Public Safety backgrounder says such orders would need the Intelligence Commissioner's approval first. The penalties in the third-reading text are real: administrative fines up to CA$250,000 per violation for a company, and criminal fines up to CA$500,000. A bill rushed through the House in the spring on claimed urgency is now looking at a half-decade of rule-writing — some of it in secret.