A group of 23 technology companies and organizations is urging Canada to amend Bill C-22 before the proposed lawful-access legislation becomes law. The September 24 coalition letter includes Kape Technologies, Nord Security, Tailscale, Tuta, Windscribe and other security, infrastructure and industry groups.
The signatories say they support the government's goal of fighting cybercrime but argue that the current draft creates three risks: new retention of personal metadata, orders that could weaken encryption or require interception capabilities, and an unresolved definition of which companies count as “core providers.”
The objections focus on data the companies do not keep today
The letter says Bill C-22 could require businesses to retain sensitive metadata for up to six months, including information their services do not currently need. The coalition argues that collecting that material would force privacy-focused providers to build new storage, access-control and audit systems while creating a valuable target for attackers.
It also warns that recent amendments may not prevent orders requiring a provider to weaken encryption or build an interception mechanism. The letter's authors argue that any such capability would expand the system's attack surface for criminals and foreign adversaries. That is the coalition's assessment of the proposal, not a finding that a particular Canadian service has already weakened its security.
The third concern is scope. The signatories say “core provider” remains undefined and that even companies outside that category could receive secret ministerial orders to change code or security architecture. They argue that customers and investors might not know which services had been affected.
TechRadar reports that Canada has promised changes to the bill's encryption and metadata rules. Public Safety Minister Gary Anandasangaree has nevertheless maintained that the core legislation is needed. The dispute now turns on whether amendments can narrow those powers enough to satisfy providers whose products depend on collecting little data and keeping communications encrypted.
