Governments worldwide tighten the vise on encryption

The war on encryption has entered a new phase. Over the past two years, governments of liberal democracies — Canada, the United Kingdom, Australia, and several European countries — have advanced legislation that, in practice, requires technology companies to create mechanisms for mandatory government access to citizens' data. The result is a world where end-to-end encryption, long considered the gold standard of digital security, is being systematically undermined by political pressure, secret court orders, and ambiguous legislation.

In Canada, Bill C-22 — enacted as the Lawful Access Act of 2026 — grants the federal government and CSIS (Canadian Security Intelligence Service) authority to issue "technical capability orders" that can compel service providers to allow access to digital information, including metadata retention for up to one year. Although the Minister of Public Safety testified before Parliament that the law is "encryption-neutral" and does not force companies to break passwords, critics from the legal community — including the Canadian Bar Association — warn that the law enables the government to require companies to build access capabilities before data is even encrypted, circumventing the protection that encryption is supposed to provide.

The tech industry reacted swiftly. Apple and Meta publicly criticized the legislation. DuckDuckGo and NordVPN said they would consider withdrawing their services from Canada. Signal, in turn, stated it would not be forced to degrade its encryption system since it never possesses decryption keys. But corporate silence has become increasingly difficult to maintain when governments issue secret orders with global reach.

In the United Kingdom, the situation is even more dramatic. In January 2025, the Home Office issued a Technical Capability Notice (TCN) against Apple, requiring the company to provide technical capability for accessing encrypted data on iCloud. Apple responded in February 2025 by completely withdrawing its Advanced Data Protection (ADP) service from the British market. In October 2025, the British government issued a second, narrower TCN focused only on UK users. In August 2026, US Director of National Intelligence Tulsi Gabbard revealed that the UK had agreed to abandon access demands for American citizens' data, but pressure on British users continued.

What makes the British case especially concerning is the absolute secrecy. The British government invoked the "neither confirm nor deny" (NCND) policy to protect intelligence secrets, preventing Apple from even discussing the case with the US Congress. When a judge at the Investigatory Powers Tribunal questioned whether this policy was sustainable, the government's lawyer admitted he could not explain the case without revealing national security secrets.

Australia was already on this path since 2018, with the Telecommunications and Other Legislation Amendment (Assistance and Access) Act — known as TOLA. Australia's law was the world's first formal regime of technical capability orders that could compel providers to "build a new capability" to access encrypted communications. Critics, including the Digital Industry Group Inc., argue that in practice this amounts to forced backdoors: if a messaging provider is obliged to create an access mechanism, that mechanism inevitably creates a vulnerability exploitable by hackers or hostile states.

What connects all these efforts is a shared logic: governments believe that access to encrypted data is essential for combating terrorism, organized crime, and hostile activities. But the cybersecurity community responds with unanimous agreement: there is no such thing as encryption with a backdoor. If a vulnerability is created for lawful authorities to access it, the same vulnerability will be discovered and exploited by criminals. As demonstrated by the Clipper Chip case in the 1990s, any government access system inevitably becomes a security risk.

The question hanging in the air is how many more jurisdictions will be needed before citizens realize that the loss of encryption was irreversible.

Sources: WIRED, CBC News, Computer Weekly

✓ Independent sources cross-checked and verified before publishing