Lawful Access Is a Backdoor

“Data collection is always a privacy risk.” Not sometimes, not only when the collector is rude, but always, because the risk is the existence of the copy itself. A copy can be subpoenaed, breached, sold, misfiled, or simply used by the next admin, who never made the promise the last admin made and feels no obligation to keep it. “Privacy isn’t paranoia, it’s how basic trust works.” Trust between people is a handshake, warm and mutual and revocable; trust in a database is a superstition, and Zero-Trust is that superstition refused.

Lawful access is the polite name for a backdoor. A backdoor is not defined by whether a lawyer blessed it; a backdoor is an entry the user does not control, built because someone with authority wanted a path that would not depend on the user’s consent in the moment. Call it a feature if you work there. On the user’s side of the glass it is a hole, and holes do not stay loyal to the reason they were drilled.

Two Bills, One Number

The bill in front of Parliament now is Bill C-22 of the 45th Parliament, short title the Lawful Access Act, 2026, “An Act respecting lawful access.” LEGISinfo records the status that matters: on October 22, 2026 it was referred to the Standing Senate Committee on National Security, Defence and Veterans Affairs. Committee is not royal assent, and this is not law while I am writing it, so treat every confident thread insisting it has already passed as a stale cache.

It is also not the other Bill C-22. In the 44th Parliament, Bill C-22 was the Canada Disability Benefit Act, which received royal assent on June 22, 2023. A disability benefit is not a wiretap statute, and anyone who mashes the two together is either careless or selling a simpler villain than the docket actually contains. I want the villain that is actually on the page.

The page, at third reading, says plainly what the government is asking for. The bill’s summary describes Part 1 as a way to facilitate access to basic information through confirmation-of-service demands to telecommunications providers, or through judicial production orders for subscriber information. Part 2 would enact the Supporting Authorized Access to Information Act, a framework so that electronic service providers can facilitate authorized access under the Criminal Code or the CSIS Act. Justice Canada describes the subscriber-information order as a court order aimed at the name, telephone number, address, and email linked to an account, with a path for the provider to challenge it and with a judge able to amend or revoke it.

That is already enough to take seriously. A court order is better than a shrug, but a new order, a new definition of subscriber information, and a duty on providers to be able to comply still amount to a requirement that the protocol grow a side door and keep its hinges oiled. Capability is the part that outlives the warrant. Once the provider must be able to produce the record, the record has to exist in a shape a stranger can receive, and “Data collection is always a privacy risk” was written for exactly that shape. The safeguard is real. The copy is also real.

I am not going to decorate this with powers the official summary does not state. If a clause does something worse, the text will show it, and the Senate committee is the room where that showing is supposed to happen. Read the bill yourself, and do not outsource the reading to a panic or to a reassurance.

The Funnel People Volunteer For

Digital identity is a different funnel, and I am not going to pretend this C-22 is that statute; I have not found a clause in the official summary that creates a national identity card. What I have said, separately, is a read of the compliance habit: “The same people will be the first in line for the digital ID just like they were for the vaccine.” That is a prediction about users, not a citation of a section. The habit is the dangerous object, because a population trained to present papers for ordinary life will experience the next paper as a convenience, and convenience is the UI of a guest account.

Informed Consent Is an Authentication Handshake is where that training got its reps. A movement license tied to a medical status was, in 2021, “just the first check conducted by the totalitarian control system called social credit.” I used the name because the shape was a permission check, not because I thought a foreign score had been copied into the Criminal Code, and the shape is what recurs. Overpasses is the emergency version of that shape. This bill is the quiet version: not a proclamation but a production order, and a provider that must always be ready.

Kernel and Key

The consumer version of the same hole is already sitting on the desktop. Anti-cheat that loads beneath the operating system asks the user to trust a driver the user cannot meaningfully audit, and in March 2026 I was done pretending that was a fair trade for a game: “We can’t tolerate kernel level spying anymore.” A game is a wonderful thing; a game that wants a higher privilege level than the player is not asking for sportsmanship, it is asking for a resident observer. I Killed Windows is one way to stop offering that observer a comfortable host. It is not a spell against every demand, only a machine you can still inspect.

The other way is to stop renting identity from a desk at all. A passkey you hold, with no KYC counter standing in the middle, is the opposite architecture: prove you possess the key, without depositing a dossier as the price of proving it. I am describing a design, not publishing a hostname. Open Weights Are Data makes the same demand of models, and Speech Is a Protocol, Not a Permission makes it of sentences. The pattern is tedious on purpose, because every time an institution says the side door is only for the guilty, the grown-up question is who holds the key to that door after the institution changes its mind.

Hold your own. Assume the copy will leak, or will be requested, because that is what copies are for. Privacy is the decision to make fewer copies, and paranoia is what they call you for noticing.

Sources: LEGISinfo, C-22 (45-1) · Bill text, third reading · Justice Canada · C-22 (44-1), Canada Disability Benefit Act