Psiphon prepares to leave Canada over lawful access bill C-22
Psiphon, the Toronto-based anti-censorship tool used by about 20 million people a month, has started drawing up plans to move its operations out of Canada because of the government's lawful access bill, C-22. "If this bill passes as written, relocating is the only way the work continues," Psiphon vice-president Kenzie Elsworthy told The Globe and Mail on October 4. The bill passed the House of Commons in June and is now before the Senate.
Psiphon grew out of the University of Toronto's Citizen Lab and is built for countries that block the open internet. According to the company, it has about 3.5 million monthly users in Myanmar, and in February, during Tehran's crackdown on protesters, it had 21 million users in Iran. It is also widely used in Russia and China.
What C-22 requires
The Lawful Access Act, 2026 was introduced on March 12 by Public Safety Minister Gary Anandasangaree. Its second part, the Supporting Authorized Access to Information Act, obliges "electronic service providers" to help police and the Canadian Security Intelligence Service (CSIS) obtain data. The government can designate some of them as "core providers" with extra duties, including building interception capabilities and keeping user metadata. Providers are exempt from measures that would introduce a "systemic vulnerability". The Electronic Frontier Foundation argues that this still lets the minister demand that companies build a backdoor into their services, as long as it is not deemed systemic.
The House of Commons passed the bill on June 18 after the government limited debate. The national security committee went through it clause by clause in a single overnight sitting, and no new amendments were allowed at the final stage. The main change made in committee cut the metadata retention period from one year to six months. Law professor Michael Geist said at the time that companies considering leaving Canada were "unlikely to conclude that it fully addresses their issues". The Senate returned on September 21 and is now studying the bill.
Why Psiphon says it cannot comply
Psiphon's code is open source, and the company says that rules out any hidden access. "You cannot build a secret backdoor into open-source code. Every line we ship is public," Elsworthy said. Any interception capability added for Canadian agencies would be visible to everyone, including the governments in Iran, Russia and Myanmar that Psiphon users are trying to avoid. "We spend our days protecting people from authoritarian surveillance. This bill would compel Psiphon to help build an arbitrary surveillance system in Canada," she said.
Psiphon has not said where it would move. It is not the only Toronto company to raise the possibility: Windscribe, a VPN provider with more than 100 million registered users, has warned it may leave Canada if C-22 becomes law. Proton made a similar move in Switzerland this year, when a proposed surveillance law pushed it to start moving servers abroad.
The government's answer
Simon Lafortune, a spokesperson for Anandasangaree, told the newspaper that "the existence of a lawful-access framework does not, on its own, make it impossible to operate a secure, privacy-protective service in Canada". He added that falling under the definition of an electronic service provider "does not mean" a company would be subject to lawful access obligations. That depends on whether the government designates it, and the bill leaves that decision to regulations that have not been written yet.
For Psiphon's users, the question is less where the company's office is than which country's laws can compel it to cooperate with security services. Senators can still amend the bill, in which case it would go back to the House of Commons.
