Psiphon VPN May Quit Canada Over a Surveillance Law

What Psiphon said

Psiphon started in 2006 as a project of the Citizen Lab at the University of Toronto. Today it is an independent company with around 20 million monthly users, many of them in Iran, Myanmar, Russia, and China, where it helps people evade state censorship. It publishes all of its code openly, which is central to how it earns trust.

That openness is exactly why Bill C-22 is a problem for it. The bill would require "electronic service providers" to build and maintain the technical means to hand information to police and the Canadian Security Intelligence Service when authorities hold legal authorization. Psiphon's vice-president Kenzie Elsworthy told the Globe and Mail the company has started drawing up plans to move its operations out of Canada if the bill passes unchanged, saying it would "force us to rewrite our code, dismantle our robust privacy architectures and design surveillance into our systems." Her summary line: "That is not lawful access. It is a published vulnerability." A backdoor cannot be hidden inside software anyone can read.

The Citizen Lab, where Psiphon was born, backed the warning on October 6. Its director Ron Deibert said the bill would make it impossible for many privacy-preserving tools to keep operating in Canada.

What Bill C-22 would actually require

The bill, formally the Lawful Access Act, 2026, was introduced on March 12 and passed the House of Commons on June 18. Its first half updates how police and CSIS obtain subscriber information, meaning basic account details like name and address, not message contents. The second half is the controversial part: it creates a framework under which electronic service providers can be required to build and maintain surveillance and monitoring capabilities.

The definition of "electronic service provider" is broad enough to reach telecoms, internet companies, messaging apps, cloud services, and VPNs. Which companies carry the heaviest duties would be settled after passage. The bill passed the House with amendments that added protections for end-to-end encryption and cut the proposed metadata retention period from twelve months to six, but the core build-it-in framework survived. It now awaits the Senate.

Apple and Meta warned back in May that the bill could require encryption backdoors and put user security at risk. The government disputes how critics read it. The companies preparing exit plans are not waiting to find out who is right.

Why your VPN's home country is a feature, not fine print

Most people pick a VPN by price, speed, and server count. This story is a reminder that the incorporation papers matter more than the marketing. A government can only compel companies inside its jurisdiction. When Canada proposes lawful-access construction duties, every VPN company based in Canada has to reckon with it, no matter what its privacy policy promises. The promises did not change; the jurisdiction did.

This is not unique to Canada. Every country with a VPN industry is one bill away from the same conversation. The pattern is always the same: a lawful-access proposal, industry warnings, amendments that soften but do not remove the core, and then companies quietly drawing up relocation plans. Psiphon is unusual only in saying the quiet part out loud, and in having 20 million users in censored countries who would feel the consequences directly.

For a remote worker, the practical question is simple: if the government where your VPN lives passed a law like this tomorrow, what would change about your traffic? If you cannot answer that, you are trusting a jurisdiction you have never evaluated. The United States is running a parallel fight over whether courts should be able to order VPNs to block piracy sites.

The architecture that has no jurisdiction problem

There is a way to make the question irrelevant. When your VPN endpoint is your own home connection, there is no provider company for any government to lean on. Nobody can order your living room router to "design surveillance into its systems," because it is yours, running software you chose, carrying only your traffic. A lawful-access bill aimed at electronic service providers has nothing to attach to.

That is the structural advantage of a home IP setup, and stories like this are when it stops being theoretical. Psiphon may leave Canada. Signal may leave Canada. Your home connection is not going anywhere, because it was never in the business of being a service provider. It also solves the everyday version of the same trust problem: when your IP address shows the wrong country, you are dealing with a provider's datacenter address and a third-party database. A home IP is one consistent residential address the internet already associates with you.

Jurisdiction shopping, picking VPNs by the privacy laws of their home country, works until the laws change. Owning the endpoint works regardless.

Tired of wondering what your VPN's home country allows?

If you want an IP address that no surveillance bill can touch, because it belongs to your own home connection, book a Pre-Travel Audit & Advisory session. It takes 1 hour, it costs $79, and that fee comes straight off the $379 Secure Home IP VPN System session if you decide to go ahead. We will get your travel router running your home IP and test everything with you.

Frequently asked questions