Allied Intelligence — 2026-10-23

Canadian Senate Debates Bill C-22 Giving Intelligence Services Backdoor Access to Encrypted Communications

BLUFBill C-22 will likely receive Royal Assent by year's end, forcing Signal and NordVPN to act on stated threats to exit Canada.

Bill C-22, the Lawful Access Act, passed third reading in the House of Commons after the Liberal government limited debate, BetaKit reported 1. The amended bill cut the proposed metadata retention period from one year to six months 1, though the Electronic Frontier Foundation said on October 22 that it still requires retention for up to a year 2. Michael Geist wrote on October 1 that the bill now says nothing compels a provider to decrypt unless it supplied the encryption and holds the key, while a carve-out excludes persons already subject to a warrant from the "systemic vulnerability" definition 3. Geist also reported that the RCMP told a House committee in May that police wanted the bill for access to encrypted communications, and that nearly two dozen technology companies and groups say the provisions still put users at risk 3. The Canadian Civil Liberties Association is petitioning the Senate, where some senators have raised constitutional concerns, according to the EFF 2.

Analysis
Since May the bill has cleared the Commons under limited debate, halved proposed metadata retention to six months, and limited decryption duties to providers holding the key, though the warrant-target carve-out remains contested. Bill C-22 will likely receive Royal Assent between October 23 and December 31, 2026. Confidence is low because the only contemporaneous Senate indicator is the EFF's report of unnamed senators' constitutional concerns, with no visible committee calendar or vote count. Sourcing is thin, resting on one commentary, one trade outlet and an advocacy group, and the sources diverge on retention terms. The text leaves both camps unsatisfied, since police want a decryption mandate while about two dozen technology firms say users remain at risk. Senate amendments could return the bill to the Commons and push passage into 2027. If it passes, Signal and NordVPN face live exit decisions and Five Eyes partners must settle data-sharing terms. A delay lets providers hold those decisions and lobby through the winter.

3 sources

Bill C-22 passes third reading after Liberals adopt measures to limit debate - BetaKit
Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill - Electronic Frontier Foundation
Is Compromise on Encryption Possible? Why Bill C-22's "Minor Opening" Leaves the Central Question Unanswered - Michael Geist (Substack)