Google raises concerns over Canada’s Bill C-22, impact on encryption

Google is the latest big tech company to take a stand against the Canadian government’s Bill C-22, also known as lawful access.

In a submission to the House of Commons committee scrutinizing the bill, the search giant said the new laws would risk compromising cybersecurity and weakening user privacy.

Google raised several concerns about the bill in its submission, including that the bill would give the government “sweeping powers to issue secret orders” to intercept or retrieve data.

Moreover, Google said the bill’s definition of an electronic service provider is so broad that it could apply to nearly any company that operates in Canada.

Elsewhere, the search giant raised alarms about Bill C-22’s lack of protections for end-to-end encryption (E2EE), warning that it could undermine security.

The government, however, argues that the bill doesn’t require companies to comply with orders if it would cause a systemic vulnerability. Google argued that the government’s definition of a systemic vulnerability is too narrow, which could create security risks.

“Google has never built a backdoor or other mechanism to circumvent end-to-end encryption in our products. If we say a product is end-to-end encrypted, it is end-to-end encrypted,” the company said.

However, Google also said it was committed to supporting law enforcement efforts, but wanted to do so “without engineering vulnerabilities” into its products and services.

Google joins the likes of Apple, Meta, and Signal in taking a stand against the lawful access bill. All of these companies have raised concerns over the bill’s potential impact on security practices like E2EE. While the government has so far disputed concerns raised by tech companies, senior officials have suggested that the government could accept amendments to Bill C-22 to address concerns.

Source: The Globe and Mail