Canada’s Senate is considering a surveillance bill that would gut encryption protections for millions of people, and time to stop it is running out.

Bill C-22, the Lawful Access Act, has already passed the House of Commons. If it clears the Senate, it will require service providers to build backdoors into encrypted communications, retain user data for potential law enforcement access, and expand warrantless surveillance powers. The Canadian Civil Liberties Association is calling it one of the most dangerous pieces of surveillance legislation the country has seen.

The bill doesn’t just ask companies to hand over data they already have. It would force them to architect their systems to make surveillance easier, the same approach that security experts have warned against for decades. Encryption either works for everyone or it doesn’t work at all. There’s no such thing as a backdoor that only the good guys can use.

Canadians can still push back. The CCLA has a petition urging senators to reject the bill, and there’s still time for public pressure to work. But the window is closing fast.

The U.S. Doubles Down on Tech Protectionism

While Canada moves to make surveillance easier, the U.S. is moving to make foreign tech harder to access.

The FCC just used a new power for the first time, blocking two gadgets because they contain chips from companies on its national security threat list. The agency won’t say which specific products got blocked, but it did name the chip: a HiSilicon component. HiSilicon is owned by Huawei, which has been on the FCC’s “covered list” since 2021.

This is new. Until October 13th, the FCC could only block devices made by listed companies. Now it can block any device containing any chip made by any company it considers a threat. FCC Chair Brendan Carr calls the chips “foreign surveillance” components, though the agency hasn’t explained what actual surveillance capability these particular chips have.

The timing lines up with broader U.S. restrictions on Chinese tech. The same week, the U.S. ordered federal agencies to remove DeepSeek’s AI models over national security concerns. Days later, DeepSeek reportedly raised $15 billion in one of China’s largest funding rounds ever. If you were trying to make Chinese AI companies more dependent on domestic funding and less integrated with U.S. markets, this is how you’d do it.

The legal framework here is worth watching. The FCC’s expanded authority gives it enormous discretion to decide what counts as a security threat at the component level. There’s no requirement to prove actual surveillance, just to assert the potential for it. That’s a lot of power with very little oversight.

New Mexico Reminds Meta That Settlements Are Optional

Meta just learned an expensive lesson about assuming everyone will settle.

A New Mexico judge hit the company with a $25 billion fine for violating state laws designed to protect children online. Meta is calling the penalty “shocking” and plans to appeal, but here’s the thing: New Mexico was part of multistate settlement talks over the same issues, and it chose to walk away and file its own case instead.

That turned out to be a very good call.

The multistate settlement would have resulted in a much smaller penalty spread across dozens of states. New Mexico’s attorney general decided the state could do better on its own, and the court agreed. The $25 billion fine is the largest penalty Meta has ever faced, and it’s a signal to other states that going it alone might be worth it.

Meta’s arguing that New Mexico is “impossible to please” and that the state moved the goalposts. But New Mexico’s case was always separate from the multistate talks. The state didn’t reject a settlement offer, it just never joined the settlement process in the first place. That’s not moving goalposts. That’s playing a different game.

The case will almost certainly be appealed, and the final number will probably come down. But the fact that a single state can credibly threaten a $25 billion penalty changes the math for future settlements. Companies can’t just assume that multistate coordination will cap their exposure anymore.

What Actually Happens Next

For Bill C-22, the next step is the Senate. If it passes, expect legal challenges on privacy and charter grounds, but those take years. The time to stop it is now, while it’s still a bill and not a law.

For the FCC’s chip blocking power, expect more gadgets to get quietly removed from the market. The agency doesn’t have to announce every decision, and manufacturers might just reformulate products rather than fight. The real test will be whether other countries retaliate with similar component-level restrictions on U.S. chips.

For Meta’s $25 billion problem, expect a long appeals process and probably a negotiated reduction. But also expect more states to consider whether they’re better off going solo. When the penalty for one state opting out is this high, the incentive to stay in multistate settlements gets a lot weaker.