The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Signal once again reminds Canadian Parliament that it is not budging on metadata collection

Happy Cybersecurity Awareness Month to those who celebrate! In this month of information safety scares, Canadian members of Parliament are once again pushing a controversial surveillance bill.

Back in May, we wrote about how Signal threatened to pull out of Canada in response to Bill C-22, which would give police and the Canadian Security Intelligence Service greater surveillance powers by requiring internet and electronic service providers to retain metadata about customers. This conversational metadata typically includes information about people’s calls and messages, such as who spoke to whom, when they spoke, and the length of a call.

In June, Minister of Public Safety Gary Anandasangaree made amendments to the bill to reduce the metadata retention requirements from one year to six months. But any metadata requirement would represent a substantial increase in data stored by Signal, which only retains a user’s phone number, and timestamps of their account creation and most recent connection to the service.

A spokesman for Anandasangaree says the proposed law would not require decryption of end-to-end encrypted services and would not “permit or compel companies to introduce systemic vulnerabilities or so-called ‘backdoors.’”

In response to the amendments, Udbhav Tiwari, Signal’s vice president of strategy and global affairs, said that “creating a much weaker version of our product that collects all of this metadata, the choice for us, unfortunately, would be starkly clear: We will not make changes to our product.”

What you can do

  • Canadians, tell your lawmakers to stop this bill. Every day, encrypted messaging apps like Signal — along with other security and privacy technologies, like virtual private networks — are used by journalists in Canada and around the world. If the bill can be weakened, it can also be stopped. Reach out to your members of Parliament to reject Bill C-22. To get started, use this tool from our friends at the Internet Society.
  • Get familiar with secure communication channels. While we’re on the topic of Signal, if you’re just getting started, read our guide for beginners. If you’re already a comfortable Signal user and want to dive deeper, read our guide to locking down Signal. But this is just one of many tools at your disposal, and it’s important to understand their underlying principles — particularly the need for end-to-end encryption and how they handle metadata — so you can adjust if you need to use a different one. Consult our guides to learn more about options for secure communications.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation