Hi Everyone,
This week on Shared Security, we discuss Canada’s proposed Bill C-22, the Lawful Access Act, and the question that never seems to leave cybersecurity policy: can law enforcement gain exceptional access to encrypted information without creating a new weakness for criminals, foreign governments, or insiders to exploit?
Bill C-22 includes language intended to prevent electronic service providers from being forced to introduce a “systemic vulnerability”. That is an important acknowledgement of the risk, but it does not answer every practical question. What capabilities might providers be asked to build? Who defines whether a risk is systemic? How are orders reviewed? What happens when regulations fill in the details later?
We also separate two issues that are often blended together. Companies already retain plenty of information that can be obtained through legal process. Encrypted content is different: it is designed so the provider cannot simply hand it over. Building a special route around that protection changes the security model, and history says any high-value access mechanism deserves serious skepticism.
Here’s the takeaway: a policy proposal should be judged not only by the public-safety aim it names, but by the technical mechanisms it creates, the independent limits it makes enforceable, and whether those limits remain meaningful when implementation details and political pressure arrive.
Links from the episode
Mozilla — Canada’s Bill C-22 threatens encryption, users’ privacy and the security of digital economies: https://blog.mozilla.org/netpolicy/2026/10/08/canadas-bill-c-22-threatens-encryption-users-privacy-and-the-security-of-digital-economies/
Parliament of Canada — Bill C-22: https://www.parl.ca/legisinfo/en/bill/45-1/c-22?view=progress
Bill text, first reading: https://www.parl.ca/documentviewer/en/45-1/bill/C-22/first-reading
Quote from this week’s episode
Can you trust the government if there is a backdoor that’s created into these different systems and technology?
— Tom Eston
Tom’s take
Public safety and privacy do not have to be enemies, but encryption is not a policy preference that can be weakened on demand without consequences. A lawful-access proposal has to be judged by the mechanisms it creates, the limits it makes enforceable, and whether those limits remain meaningful when implementation details and future political pressure eventually happens.
Also worth your attention this week
Smart glasses are becoming a governance problem, not merely a gadget story. A Westminster ban call puts covert recording, institutional rules, and social consent in focus. Source
YouTube Music is adding labels for AI-generated content. Provenance labels help only when people understand what they do—and do not—verify. Source
Character.ai’s Chapter 11 puts AI-companion durability and user-data continuity on the table. Its court-supervised sale process raises practical questions about what users retain when an AI platform fails. Source
Listen / Watch
🎧 Audio Podcast: https://sharedsecurity.net/2026/10/19/canadas-bill-c-22-encryption-lawful-access-and-systemic-risk/
▶️ YouTube Version: https://youtu.be/PjoQr6LuOOo
We’d love your feedback
Should governments be able to compel technical access to encrypted services if a provider says the requirement creates a security risk? Reply to this email or join the discussion at https://sharedsecurity.net/contact.
Thank you to our sponsors!
Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com.
🎁 Get 10% off your order of high quality faraday products built to protect your privacy from SLNT! Visit: https://slnt.com and use discount code "sharedsecurity" at checkout.
Closing
Thanks for supporting the podcast! Until next time, stay safe, stay secure, and stay private.
Tom Eston
Founder and Host, Shared Security Podcast
