Loading story…
Canada’s proposed lawful access bill, Bill C-22, drew opposition from Signal, Apple, Google, Meta, NordVPN, DuckDuckGo, Windscribe, and Tailscale, which warned that the measure could force providers to weaken encryption, retain user metadata for up to one year, and build technical capabilities for government access. Critics said the bill’s use of secret ministerial orders and limited judicial oversight could undermine privacy commitments, raise compliance costs, and create new security weaknesses that malicious actors could exploit.
Canadian officials said the legislation is intended to modernize investigative powers and that amendments will clarify it is not meant to break encryption, but the government plans to preserve the one-year metadata retention requirement. Civil liberties groups and researchers including Citizen Lab and the Canadian Civil Liberties Association argued that the metadata retention and ministerial-order provisions should be removed entirely, warning that the proposal deepens the conflict between lawful access demands and the need to protect privacy, cybersecurity, and secure communications.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Public Safety Minister Gary Anandasangaree said amendments to Bill C-22 will clarify that the legislation is not intended to undermine encryption, while the government plans to retain the one-year metadata retention provision.
Signal, NordVPN, Windscribe, DuckDuckGo, Apple, Google, Meta, Tailscale, and privacy advocates publicly opposed Canada's proposed lawful access bill, warning it could weaken encryption, mandate metadata retention, and require government access capabilities.
Airline passengers asked the full Fifth Circuit Court of Appeals to rehear their lawsuit against CrowdStrike, arguing their claims concern CrowdStrike's negligence as a software developer rather than airline services. CrowdStrike said it remains confident the dismissal will be upheld.
A U.S. District judge and later a three-judge Fifth Circuit panel held that airline passengers' claims against CrowdStrike were preempted by the Airline Deregulation Act.
In July 2024, a defective CrowdStrike Falcon software update caused a major outage that disrupted 8.5 million systems and led to airline-related disruptions affecting passengers.
On 2026-06-02, Citizen Lab submitted an analysis of Canada's Bill C-22 to the Standing Senate Committee, warning that the proposal could impose broad surveillance obligations, threaten human rights and transparency, weaken encryption, and harm cybersecurity. The submission recommended withdrawing several elements of the bill and amending others to reduce harm.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecysecurity.news
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ireland’s government announced plans to introduce the **Communications (Interception and Lawful Access) Bill**, a legislative overhaul intended to modernize the country’s lawful interception framework and explicitly provide a legal basis for law enforcement use of **spyware**. Officials said the existing **Postal Packets and Telecommunications Messages (Regulation) Act 1993** predates modern communications, particularly end-to-end encrypted messaging, and argued a new framework is needed to address serious crime and security threats while adding “robust” safeguards to ensure powers are necessary and proportionate. The proposed bill is described as covering **“all forms of communications, whether encrypted or not,”** and enabling access to both **content and metadata**, expanding scope to services and device categories such as electronic messaging platforms, email, and **IoT** communications. While the announcement emphasizes privacy/security safeguards and increased technical cooperation between state agencies and service providers, reporting notes it does not clearly explain the technical mechanism for accessing encrypted communications—an outcome that in practice often requires **device compromise** (e.g., government-grade spyware) or local forensic extraction tools (e.g., *Cellebrite*). The government also indicated alignment with the EU Commission’s roadmap on lawful access and encryption-related interception issues.
Jun 29, 2026
A coalition of 127 civil society organizations and trade unions has voiced strong opposition to the European Union's proposed Digital Omnibus changes, warning that these reforms could significantly weaken existing data protection and privacy laws such as the GDPR. The proposed legislation is criticized for potentially reducing safeguards on personal data, including genetic and biometric information, and for making it easier to use such data in AI training and online tracking. The coalition also expressed concern over the lack of transparency and democratic oversight in the legislative process, urging the European Commission to maintain robust digital rights protections. In parallel, more than 60 digital commerce and trade groups have called on governments worldwide to reject any efforts to weaken or bypass encryption, emphasizing that strong encryption is essential for user privacy, secure data protection, and trust in digital interactions. These groups argue that introducing backdoors or technical mandates for lawful access would undermine security for all users, outweighing any potential benefits for law enforcement. The letter comes amid ongoing debates in Europe and elsewhere about mandating access to encrypted data for criminal and national security investigations.
Jul 12, 2026
Apple has filed a new legal challenge against a U.K. government demand for access to encrypted iCloud backup data, escalating a dispute over the country's use of secret **technical capability notices** under the Investigatory Powers Act. The case, reported as being brought before the Investigatory Powers Tribunal, targets a narrower order focused on U.K. users after an earlier, broader demand that reportedly extended to both U.K. and U.S. users was withdrawn following diplomatic friction with Washington. The contested notice is widely described by critics as an attempt to force an effective backdoor into iCloud backups protected by **Advanced Data Protection**. Apple has argued that creating such access would weaken security for all users, and the company had previously removed the option for U.K. customers to enable Advanced Data Protection after the first order. Civil liberties groups including **Privacy International** and **Liberty** have also challenged the government's use of these notices in a separate case scheduled for hearing in December.
Aug 5, 2026