Canada Built Psiphon. Bill C-22 May Drive It Out.

When an anti-censorship tool born in Canada says Ottawa’s lawful-access bill could force it out, the Senate should stop and demand receipts.

Bill C-22 is no longer just a privacy-theory fight. It is now a Canadian innovation and jobs warning.

Citizen Lab reported October 6 that Psiphon, a Toronto-based anti-censorship software company spun out of Citizen Lab, plans to leave Canada if the federal government’s lawful-access bill passes in its current form. The company began as a University of Toronto/Citizen Lab project in 2006 and now reaches about 20 million monthly users around the world, including people trying to bypass censorship in Iran, Myanmar, Russia and China.

That matters because Psiphon is exactly the kind of Canadian-made freedom technology Ottawa should want to keep. Instead, Bill C-22 may tell privacy-first builders that Canada is too risky a jurisdiction for open-source security work. Citizen Lab says the bill could require electronic service providers to make secret system changes so police and CSIS can obtain surveillance and monitoring capabilities. Psiphon’s concern is straightforward: if trust depends on inspectable open-source code, a secret access requirement can become a public vulnerability.

Parliament’s own LEGISinfo page identifies C-22 as the Lawful Access Act, 2026. It passed the House on June 18 and is now at second reading in the Senate. That means senators still have time to ask the basic conservative accountability question: what will this cost Canada in jobs, trust, exports and civil liberties?

The government says lawful access is needed so police and CSIS can get information they are legally authorized to obtain. Public safety is real. Child exploitation, terrorism, organized crime and foreign interference are not imaginary problems. But a serious government does not wave away technical objections from the people who actually build secure systems. It proves the guardrails in writing.

The Privacy Commissioner already told MPs that Bill C-22 still needed stronger safeguards. Philippe Dufresne recommended narrowing subscriber-information powers, limiting obligations to what is necessary and proportionate, and clarifying that “systemic vulnerability” includes steps that would make authentication or encryption less effective. That is not anti-police rhetoric. It is the privacy watchdog telling Parliament to tighten the law before it breaks trust.

The Senate should now require a privacy-tools impact ledger before moving C-22 another inch. Publish the list of provider categories that could be covered. Publish the encryption red lines. Publish how secret orders would be reviewed, challenged and reported. Publish whether open-source tools, VPNs, messaging apps and anti-censorship services could be compelled to alter code, retain metadata or keep users in the dark.

If Ottawa funds and celebrates anti-censorship technology abroad while drafting rules that push the same technology out of Canada, that is not modernization. It is policy incoherence with a moving truck parked outside a Canadian company’s door.