Mozilla sounds alarm over Canadian Bill C-22 that could weaken encryption and put user privacy at risk
Mozilla raises concerns over Canada’s Bill C-22, which could potentially weaken encryption and pose serious risks to our privacy.
More specifically, the second part of the bill, the “Supporting Authorized Access to Information Act” (SAAIA), raises red flags by granting authorities the power to require electronic service providers to develop mechanisms to facilitate government access to information.
If passed in its current form, the Firefox developer argues, companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken, or otherwise defeat encryption, access data before encryption, or decrypt encrypted data to provide access to law enforcement.
In addition, companies could be compelled to retain and access data they’ve purposefully chosen not to collect.
Such backdoors not only undermine people’s right to privacy and data protection, but also pose serious risks to the trust and security premises users rely on. For example, the encryption that protects private conversations is also used to protect financial transactions, health data, business systems, and critical digital services.
“Let us be clear: there is no safe way to create exceptional access to encrypted data that only the intended actor can use. An access mechanism created for law enforcement can also be discovered, exploited, or abused by potentially bad actors,” Mozilla says in a blog detailing the risks of Bill C-22.
Instead of asking tech companies to build backdoors, they should be encouraged to patch vulnerabilities, Mozilla argues.
The company is also concerned about Bill C-22’s scope. It wouldn’t be limited to Canadian services or users, but would affect people’s privacy and security worldwide. Furthermore, the bill’s confidentiality requirements would make it impossible for services to inform their users about security breaches or secretive backdoors.
“We call on Canadian policymakers not to rush the legislative process to take experts’ feedback into account in amending C-22 to protect everyone’s security and privacy. Canada’s interests are best served by regulation that protects encryption, strengthens cybersecurity, and emphasizes transparency, checks, and balances,” the Firefox developer concludes.
Earlier this week, Mozilla called out Microsoft for knowingly steering Windows users toward Edge and interfering with users’ free choice of web browser.