Psiphon, the Toronto-based circumvention tool born out of the University of Toronto's Citizen Lab in 2006, has told the Globe and Mail it will relocate out of Canada if Bill C-22 passes in its current form. The company serves 20 million monthly users worldwide who depend on its software to bypass state censorship in Iran, Myanmar, Russia, and China. The bill would make staying incompatible with its core mission. Bill C-22, the federal government's lawful-access legislation, would require electronic service providers to make secret modifications to their systems — building in surveillance and monitoring capabilities for police services and the Canadian Security Intelligence Service (CSIS). The mandate is not optional: providers would be compelled to engineer backdoors that neither users nor the public would know about. The structural problem is simple. A backdoor built for CSIS is a backdoor. It does not check passports. Any covert access mechanism engineered into Psiphon's infrastructure could, in principle, be discovered and exploited by the very authoritarian regimes the tool was designed to defeat. For users in Tehran or Yangon, this is not an abstract civil-liberties debate — it is an operational security threat. Citizen Lab director Ron Deibert frames the damage broadly: Bill C-22 "will make it impossible for a large number of invaluable privacy-preserving tools and applications from operating in Canada." Psiphon is the most visible case, but the logic applies to any encryption-dependent service. If you must build secret surveillance capabilities into your product, you cannot credibly promise privacy to anyone. The irony is thick. Canada has spent two decades cultivating a reputation as a responsible actor in internet freedom — funding circumvention research, hosting Citizen Lab, and positioning itself as a counterweight to authoritarian digital governance. Bill C-22 would force the products of that investment to leave the country or betray their users. The policy does not just fail to create new capability; it actively destroys existing Canadian-built infrastructure that serves 20 million people globally. The bill's backers frame this as a security imperative: law enforcement needs technical access to pursue criminals. But the tradeoff is not encryption-versus-crime. It is whether Canada will host privacy infrastructure or export it. Psiphon will not cease to exist — it will simply operate from a jurisdiction that does not require it to compromise its users. Canada loses the company, the talent, the institutional knowledge, and the moral authority. The surveillance capability gained is marginal at best, because serious targets will simply move to tools outside Canadian jurisdiction. What makes this case structurally important is the precedent. If Canada — a Five Eyes member with a strong rule-of-law reputation — mandates secret backdoors, it validates the same demand from every government that asks. The argument "even Canada requires this" will be used in Ankara, New Delhi, and Brasília. The 20-year trajectory is a race to the bottom in which privacy-preserving tools are pushed into ever-smaller jurisdictional safe harbors, and democratic governments functionally align their technical mandates with authoritarian ones.
