Canadian privacy technology company Psiphon is preparing to move its operations out of Canada over proposed legislation that it believes could undermine the security of millions of internet users worldwide.
The Toronto-based company, which helps people bypass government censorship and access blocked websites, says it cannot accept requirements that could force it to introduce surveillance capabilities into its software. Its warning concerns Bill C-22, legislation intended to expand law enforcement access to digital information.
Psiphon began in 2006 as a project at the University of Toronto’s Citizen Lab before becoming an independent company. Today, its technology serves approximately 20 million monthly users, including people in countries such as Iran, China, Russia and Myanmar, where internet access is heavily restricted.
The proposed Canadian law would establish new obligations for certain electronic service providers, potentially requiring them to maintain technical capabilities to assist police and intelligence agencies with legally authorized investigations.
Psiphon argues that these requirements could conflict with its open-source approach, which allows researchers and users to examine its software for security weaknesses.
Company vice-president Kenzie Elsworthy warned that introducing surveillance functionality could expose users to additional risks. Because Psiphon’s code is publicly available, any mechanism designed to provide special access could potentially be discovered and exploited by governments seeking to monitor people who use the service.
The company has reportedly begun preparing relocation plans rather than risk compromising the protections its users depend on.
Psiphon is not alone in opposing the legislation. Privacy-focused companies including Signal, NordVPN and Windscribe have also warned that they could reduce or end their Canadian operations if the law threatens their security commitments.
Canadian officials maintain that Bill C-22 is necessary to modernize investigations involving serious crime and national security threats. The government argues that the legislation would not permit unrestricted surveillance or direct police access to company systems.
Lawmakers have already amended the proposal to strengthen protections for end-to-end encryption and reduce the maximum metadata retention period from 12 months to six months. However, critics maintain that the remaining provisions could still create security and privacy risks.
Bill C-22 has passed Canada’s House of Commons and is now being considered by the Senate. It has not yet become law, meaning further changes remain possible.
For Psiphon, the outcome could determine whether a privacy service developed in Canada two decades ago can continue operating from the country without changing the technology used to protect its users.