Signal tells senators it won’t comply with Bill C-22’s encryption and metadata powers

Signal, the encrypted messaging service, has told Canadian senators and other lawmakers it will not comply with Bill C-22, the Lawful Access Act, if the bill becomes law and is enforced. Udbhav Tiwari, the non-profit’s vice-president of strategy and global affairs, made the case at a small gathering on Monday evening, BetaKit reported. The event was organized by the Canadian Internet Society, which said the session was recorded and would be sent to the relevant Senate committees.

Tiwari laid out three objections: how the bill treats encryption, how it handles metadata and its technical access measures. He said the law could let authorities sidestep Signal’s encryption by ordering it to hand over encryption keys, require it to collect more than the minimal metadata it now keeps and store it for six months, or compel a targeted change to the app so it gathers more information. “For us, this is a serious enough issue that it would fundamentally break Signal,” he said, adding that the organization would not alter its products to meet demands that put the privacy of Canadians and users elsewhere at risk.

The bill has two main parts. The first adds Criminal Code tools, which the Department of Justice says respond to Supreme Court of Canada rulings in R. v. Spencer and R. v. Bykovets that police need lawful authority to obtain basic information. They include a “confirmation of service” demand that lets police ask a telecom or internet provider a yes-or-no question about whether it serves a person, based on reasonable suspicion, and a new court order for subscriber details such as a name, address, phone number and email. Providers would have five business days to challenge a confirmation demand in court.

Signal’s concerns centre on the second part, a new Supporting Authorized Access to Information Act. According to an analysis by law firm Norton Rose Fulbright, it would let cabinet and the minister, through regulations or ministerial orders, require electronic service providers to build and maintain technical capabilities, install equipment that enables authorized access and keep categories of metadata for up to six months, down from one year in the original draft. Some providers could be designated “core providers” with heavier duties, and non-compliance could bring administrative penalties of up to $500,000.

Encryption has become the central fight. Michael Geist, who testified on the bill before the House of Commons, wrote last month that MPs amended the bill to say nothing compels a provider to decrypt information unless it supplied the encryption and holds the key, but left a carve-out for people already under a warrant. Public Safety Minister Gary Anandasangaree has told the Toronto Star the bill strikes “the right balance,” with only a “minor opening,” Geist noted, while police leaders say it does too little; Ontario Provincial Police Commissioner Thomas Carrique called encryption “a significant sticking point.” Geist argued the Senate will ultimately have to “pick a side.”

The pushback extends beyond Signal. Civil liberties groups say the bill would give police unprecedented surveillance powers, and Canadian and European tech companies warned in an open letter last month that it would “erode trust” in Canada’s tech sector, BetaKit reported. European civil society groups have also urged EU leaders, in a letter published by Access Now, to press Ottawa to drop the capability mandates and blanket data retention. The letter says the bill was referred to the Senate in June after passing the House, and that committee study could wrap up as early as October.

Tiwari said Signal has never deliberately cut off a country. Where it has refused to follow laws, as in Russia, China and North Korea, governments have instead ordered internet providers to throttle the app, and he said a similar sequence would have to unfold before Signal became unavailable to Canadians. A standoff is possible, he said, but he thinks the powers in C-22 make that outcome very unlikely.

Sources: BetaKit; Department of Justice Canada, Bill C-22 Part 1; Norton Rose Fulbright; Michael Geist; Access Now.