Tech, VPN companies call on Ottawa to make more changes to lawful-access bill

Tech, VPN companies call on Ottawa to make more changes to lawful-access bill MARIE WOOLF OTTAWA PUBLISHED 14 MINUTES AGO COMMENTS SHARE SAVE FOR LATER Tech companies delivering digital services to Canadians, including cybersecurity, have written to federal ministers urging further changes to Ottawa’s lawful-access bill, saying it still creates “serious business risks” in its current form. Known as Bill C-22, the lawful-access bill would require telecoms, internet companies and other digital service providers to make changes to their systems to give surveillance and monitoring capabilities to police services and the Canadian Security Intelligence Service. CSIS and law enforcement have long argued that Canada is lagging behind its Five Eyes intelligence partners in not having such a lawful-access regime to aid investigations. The government amended Bill C-22 in the House of Commons before its summer recess to address concerns, including from tech giants Apple Inc. and Meta Platforms Inc., that the bill could compromise Canadians’ cybersecurity and privacy. One such amendment explicitly protects end-to-end encryption. The bill is now due to be scrutinized in the Senate. A letter sent to Public Safety Minister Gary Anandasangaree and Industry Minister Mélanie Joly on Thursday argues that the amendments did not go far enough. Ottawa lawful-access bill could be obstacle to EU-Canada digital trade agreement, European privacy groups say It was signed by 20 tech organizations and companies, including security companies that provide virtual private networks, or VPNs, that encrypt a user’s internet traffic and can disguise the location where they are connecting to the internet from. The letter expresses concerns that, even after amendments, the bill would force companies to weaken encryption or “build intercept capabilities.” “Weakening encryption could expose customers’ sensitive financial, identity, and transaction data to criminals and other unauthorized actors,” the letter says. “A backdoor for law enforcement is a backdoor for everyone. Once built, it would permanently expand the attack surface for criminal actors and foreign adversaries.” Among the amendments introduced by Mr. Anandasangaree in June was a change to reduce the amount of time that companies would be required to retain metadata on their customers from up to a year to six months. The metadata would not include e-mails, web-browsing history, social-media activity or text messages, but…