Toronto-based censorship circumvention provider Psiphon is preparing to move its operations out of Canada if Bill C-22 passes in its current form, warning that surveillance obligations could undermine the protections its users depend on.
The company disclosed its relocation plans to The Globe and Mail. Citizen Lab, where Psiphon originated, also highlighted the development in an October 6 announcement.
Psiphon vice-president Kenzie Elsworthy said the proposed lawful-access framework threatens both the company’s security architecture and the transparency that makes its software trustworthy.
Created as a University of Toronto Citizen Lab project in 2006 before becoming an independent company, Psiphon serves approximately 20 million monthly users worldwide.
The service combines VPN technology with routing protocols and globally distributed servers to maintain access when governments block connections.
Surveillance and open-source concerns
Bill C-22 would establish a framework requiring covered electronic service providers to develop technical capabilities that support authorized access to information by police and the Canadian Security Intelligence Service. The proposed legislation also restricts disclosure of ministerial orders, including whether a provider has received one.
For Psiphon, those requirements could conflict with its open-source model, which allows users and researchers to inspect its code.
Elsworthy argues that adding surveillance functionality would either compromise that transparency or expose the capability to authoritarian governments examining the same publicly available software. Either outcome, she warned, would undermine user trust and potentially jeopardize the people Psiphon exists to protect.
The company says uncertainty about which providers would face obligations means it must assume it could be covered when planning its future.
Psiphon joins other providers considering an exit, including Toronto-based Windscribe, which reports more than 100 million registered users worldwide. VPN operators were among the companies that urged Ottawa last month to further revise the bill over encryption and interception concerns. Previously, Apple, Meta, Signal, and Proton VPN also voiced their concerns.
In June 2026, Citizen Lab and the Canadian Civil Liberties Association sought withdrawal of key provisions, citing surveillance powers, metadata retention, and cybersecurity risks.
Canada defends the framework
The government amended Bill C-22 before the summer recess to address privacy and cybersecurity concerns. The current text limits compelled decryption and provides protections against requirements that introduce a defined systemic vulnerability. The bill is at second reading in the Senate.
Public Safety Minister Gary Anandasangaree’s spokesperson, Simon Lafortune, stated that operating a secure service would remain possible. He said most electronic service providers would neither qualify as core providers nor face ministerial orders, with obligations depending on factors including their services and Canadian usage.
Leave a Reply