Canada's Bill C-22 Is a Repackaged Version of Last Year's Surveillance Nightmare
379 points
• 6 days ago
• Article
Link
Canada 的 Bill C-22（The Lawful Access Act）重新引入了有问题的监控措施，几乎是去年被撤回的 Bill C-2 的翻版。尽管 Bill C-2 在隐私团体强烈反对后被撤回，Bill C-22 却以边境安全为由保留了许多相同的问题，试图以牺牲数字隐私为代价扩大政府的监控权力。
该法案将要求包括电信运营商和消息应用在内的数字服务记录并保存用户的元数据长达一年。元数据能揭示人们的通讯对象、位置以及日常行为模式。扩大元数据的收集与保存，会迫使企业存储比现在更多的个人信息，从而增加数据泄露和被恶意方未经授权访问的风险。
更令人担忧的是，法案授权 Canada 的 Minister of Public Safety 要求公司为其服务设置后门，供执法部门访问。法案声称这些命令不会引入"systemic vulnerabilities"，但专家指出在处理加密通信时，这在技术上不可能实现。法案还禁止公司公开披露此类政府命令的存在，完全消除了监控活动的透明度。
法案中对"systemic vulnerabilities"和"encryption"的定义模糊不清，为政府越权留下了大量空间。加拿大官员声称可以在不造成系统性漏洞的情况下增加监控，但这与技术现实相悖。宽泛的定义可能涵盖各类应用和操作系统，从而影响范围广泛的数字服务。
这一做法与英国的情况类似：英国政府曾要求 Apple 在其 Advanced Data Protection 功能中设置后门，Apple 最终为英国用户移除了该功能而非妥协。 Meta 和 Apple 都对 Bill C-22 可能赋予 Canadian authorities 类似权力表示担忧，并公开反对该法案。 US House Judiciary and Foreign Affairs committees 也在致 Canada 的 Minister of Public Safety 的联名信中表达了关切。
现实事件已经证明了监控后门的危险，例如 2024 年的 "Salt Typhoon" 黑客事件，攻击者正是利用了为执法访问用户数据而建立的系统。构建这些监控机制必然会带来可被恶意利用的漏洞。
公众理应享有强有力的隐私保护、透明的数据处理以及对加密信息的明确保障。 Bill C-22 未能提供这些保护，反而推动扩大所谓的合法访问机制，将危及数百万用户的数字安全。
Canada's Bill C-22, also known as The Lawful Access Act, is a reintroduction of problematic surveillance measures that mirror last year's failed Bill C-2. While Bill C-2 was withdrawn after significant backlash from the privacy community, Bill C-22 retains many of the same concerns under the guise of border security. The legislation represents another attempt to expand government surveillance powers at the expense of digital privacy rights.
The bill would force digital services, including telecoms and messaging apps, to record and retain user metadata for a full year. Metadata reveals extensive information about who people communicate with, their locations, and their daily patterns. Expanding metadata collection requirements would compel companies to store even more personal data than they currently maintain, creating larger targets for potential data breaches and unauthorized access by bad actors.
Perhaps most concerning is the provision allowing Canada's Minister of Public Safety to demand companies create backdoors in their services for law enforcement access. The bill claims these mandates cannot introduce "systemic vulnerabilities," though experts note this is technically impossible when dealing with encrypted communications. The legislation also prohibits companies from publicly disclosing the existence of such government orders, eliminating transparency around surveillance activities.
The definitions of both "systemic vulnerabilities" and "encryption" remain unclear throughout the bill, leaving significant room for government overreach. Canadian officials have maintained it's possible to add surveillance without creating systemic vulnerabilities, but this contradicts technical reality. The broad definitions could encompass apps and operating systems alike, potentially affecting a wide range of digital services.
This approach mirrors what occurred in the UK, where the government demanded Apple implement backdoors into its Advanced Data Protection feature. Apple ultimately removed the feature for UK users rather than comply. Both Meta and Apple have expressed concerns that Bill C-22 would grant Canadian authorities similar powers, and both companies have publicly opposed the legislation. The US House Judiciary and Foreign Affairs committees also raised concerns in a joint letter to Canada's Minister of Public Safety.
The dangers of surveillance backdoors are demonstrated by real-world incidents like the 2024 Salt Typhoon hack, which exploited systems built for law enforcement access to user data. Building these surveillance mechanisms inevitably creates vulnerabilities that malicious actors can access. Canadians deserve robust privacy protections, transparent data handling, and clear safeguards for encrypted information. Bill C-22 fails to provide any of these protections, instead pushing for expansive lawful access mechanisms that would compromise digital security for millions of users.
134 comments • Comments Link
• Bill C-22 的强制性数据保留和加密后门条款可能迫使 Signal 、 WhatsApp 和 iMessage 等端到端加密通讯服务将加拿大用户完全屏蔽，因为这些要求与端到端加密不兼容，且在欧盟已被裁定为非法。
• 包括 Internet Society 、 OpenMedia 和 ICLM 在内的多个倡导组织已建立工具，帮助公民联系议员和部长以反对该立法。加拿大公民自由协会也发布了对该法案影响的详细分析。
• 关于政治行动在加拿大是否有效存在重大分歧：有人认为 FPTP 投票制使个人选票失去意义，另一些人则反驳称加拿大远未达到像俄罗斯那样真正危险的威权状态。
• 一些评论者对发达国家与发展中国家的自由状况进行了对比，指出尽管某些发展中国家在法律上形式自由度较低，但由于治理薄弱、现金经济普遍以及住房和商业监管较少，日常生活中反而享有更多实际自由。
• 该立法似乎深受英国《在线安全法》和加拿大最高法院 Bykovets（2024）案裁决的影响。情报机构声称这些裁决阻碍了其数据收集能力，导致 CSIS 所说的 "going dark"。
• 多位评论者指出，一旦监控基础设施投入使用，即便名义上更名或停止运作，也很难被彻底拆除；他们以 Total Information Awareness 和 Carrier-IQ 等多次更名的项目为例。
• 人们担忧自由党政府有重复尝试通过类似法案的模式：把失败的立法换个名字反复提交，直到最终通过，迫使公民反复抗争。
• 讨论强调了潜在的企业共谋，指出 Apple 和 Google 等大型科技公司本可通过拒绝实施严苛控制来阻止此类立法，但当合规能保护其垄断利益时，它们往往选择配合。
• 一些评论者对主流媒体在自由党提出监控立法时的监督不如在保守党执政时严格表示沮丧，暗示数字权利相关报道存在党派偏见。
• 最近对 James Comey 的起诉被引用为警示案例：指控基于一张模糊的 Instagram 照片，照片中贝壳排列成 "8647"，说明监控权力如何被用来将可多种解读的言论刑事化。
讨论表明，公众对 Bill C-22 对加拿大数字隐私与加密通信的影响深感担忧。参与者利用国际比较、历史先例和技术理解来反对该法案。尽管对政治行动能否有效以及不同治理体系下的相对自由存在分歧，但广泛共识是：一旦建立，监控基础设施往往会持续扩张。讨论同时凸显了政府权力扩张与企业合规之间的复杂关系，有人认为科技垄断通过愿意实施利于国家监控和自身利益的控制措施，助长了这种立法。 • Bill C-22's mandatory data retention and encryption backdoor provisions would likely force encrypted messaging services like Signal, WhatsApp, and iMessage to block Canadian users entirely, as these requirements are incompatible with end-to-end encryption and have already been ruled illegal in the European Union.
• Multiple advocacy groups including the Internet Society, OpenMedia, and ICLM have created tools to help citizens contact their MPs and government ministers to oppose the legislation, with the Canadian Civil Liberties Association publishing detailed analysis of the bill's implications.
• There's significant debate about whether political action matters in Canada, with some arguing FPTP voting makes individual votes meaningless, while others counter that Canada remains far from authoritarian states like Russia where voting is genuinely dangerous.
• Some commenters draw paradoxical comparisons between developed and developing nations, arguing that despite less formal freedom on paper, some developing countries offer more practical day-to-day liberty through weaker governance, cash economies, and less regulatory burden on housing and business.
• The legislation appears heavily influenced by the UK's Online Safety Act and Canadian Supreme Court decisions like Bykovets (2024) that intelligence agencies claim have hampered their data collection capabilities, leading to what CSIS calls "going dark."
• Several commenters note that surveillance infrastructure, once implemented, is never truly dismantled even if officially renamed or discontinued, citing examples like Total Information Awareness and Carrier-IQ that evolved through multiple rebrandings.
• There's concern about the Liberal government's repeated attempts to pass similar legislation, with the pattern being to reintroduce failed bills under new names until they eventually succeed, requiring citizens to defend against such proposals repeatedly.
• The discussion highlights potential corporate complicity, noting that major tech companies like Apple and Google could effectively block such legislation by refusing to implement draconian controls, but choose compliance when it protects their monopolistic interests.
• Some commenters express frustration that mainstream media provides less scrutiny of surveillance legislation when proposed by Liberal governments compared to Conservative ones, suggesting partisan bias in coverage of digital rights issues.
• The recent indictment of James Comey based on an ambiguous Instagram photo of seashells arranged as "8647" is cited as a cautionary example of how surveillance powers can be used to criminalize speech that can be interpreted in multiple ways.
The discussion reveals deep concern about Bill C-22's implications for digital privacy and encryption in Canada, with participants drawing on international comparisons, historical precedents, and technical understanding to argue against the legislation. While there's disagreement about the effectiveness of political action and the relative freedoms in different governance systems, there's broad consensus that surveillance infrastructure tends to expand permanently once established. The conversation also highlights the complex relationship between government power grabs and corporate compliance, with some arguing that tech monopolies enable such legislation through their willingness to implement controls that serve both state surveillance and corporate interests.