Bill C-22, the Lawful Access Act, has passed Canada's House of Commons and now sits before the Senate. The legislation grants the federal government sweeping new powers to compel digital service providers—telecom companies, messaging platforms, and other communications intermediaries—to assist with government surveillance operations. The most consequential provision allows Canada's Minister of Public Safety to order companies to build backdoor access into their services for law enforcement, subject only to the vague constraint that such access must not create "systemic insecurity." That qualifier does almost no work. Any deliberately introduced weakness in encryption is, by definition, a systemic vulnerability. The distinction between a backdoor that creates "systemic insecurity" and one that doesn't is a policy fiction. Once a backdoor exists, it exists for every actor capable of finding it—foreign intelligence services, criminal hackers, and authoritarian governments included. The bill's framing treats encryption as a dial that can be turned down for police without being turned down for everyone else. The metadata retention mandate requires services to store communications metadata for up to one year. This covers who contacts whom, when, from where, and which services are used—a comprehensive behavioral map of every user, collected regardless of whether any suspicion of criminal activity exists. Metadata, as intelligence agencies have long acknowledged, is often more revealing than content. A year of it, stored by default across the entire population, constitutes a mass surveillance infrastructure built in advance of any investigative need. Researchers at the Canadian Civil Liberties Association and Citizen Lab published a detailed constitutional and cybersecurity analysis of C-22, concluding that the bill's problems are structural, not cosmetic. Their recommendation is not amendment but wholesale withdrawal of Part 2, the section establishing the surveillance and data retention regime. Several Canadian senators have independently raised concerns about the bill's compatibility with privacy protections in the Canadian Charter of Rights and Freedoms. The cross-border dimension compounds the risk. Canada has been negotiating a data-sharing agreement with the United States that would allow American law enforcement to access information about Canadian internet users without requiring authorization from any Canadian court. Bill C-22 would expand the volume and availability of data eligible for such sharing, effectively building a surveillance pipeline that operates outside Canadian judicial oversight. The CCLA is urging Canadians to sign its petition opposing C-22 while the Senate still has the bill under review. The window for public intervention is narrowing. If the Senate passes C-22 as written, Canada will have legislated both a backdoor mandate and a population-wide metadata dragnet into its communications infrastructure—capabilities that, once built, are extraordinarily difficult to dismantle. The core question is not whether law enforcement needs modern investigative tools. It does. The question is whether building permanent surveillance architecture into the communications of an entire population—with ministerial rather than judicial authorization, and with cross-border sharing baked in—is a proportionate response. The CCLA, Citizen Lab, and a growing number of senators have concluded it is not.
