Updated October 2026: This post has been expanded from its original March 2024 version to cover both sides of the debate, Canada’s retreat from an outright ban, and practical steps against keyless car theft. It is a historical account; details describe the time it covers, not today.
On February 8, 2024, at a national summit on auto theft in Ottawa, Canada’s Minister of Innovation, Science and Industry, François-Philippe Champagne, said the government would ban devices used to steal cars by copying the wireless signals of keyless entry fobs. Only one product was named: the Flipper Zero, a pocket-sized gadget popular with security researchers and hobbyists.
The announcement set off weeks of pushback from the device’s maker, security professionals and digital rights groups, including a petition and a Canadian campaign site, SaveFlipper.ca. By late March the government had backed away from an outright ban. This post looks at why Canada targeted the device, why critics said it had the wrong target, how the policy changed, and what actually helps protect a car today.
The problem Canada was trying to solve
Car theft in Canada had risen sharply. Public Safety Canada’s summit materials reported that vehicle thefts in 2022 had climbed by 50 percent in Quebec and 48 percent in Ontario compared with 2021, with smaller increases in Atlantic Canada and Alberta. The Canada Border Services Agency’s interceptions of stolen vehicles, many headed overseas through ports, grew from 463 in 2018 to more than 1,800 in 2023. Police in the Greater Toronto Area reported carjackings up 104 percent from 2021 to 2022.
The government’s summit package was broad. It included $28 million for the CBSA to examine more shipping containers, better information sharing between police and rail police, updates to vehicle safety standards, a review of Criminal Code penalties, and work with industry on anti-theft technology. The device ban was one item among many, but it drew most of the attention.
What the Flipper Zero is
The Flipper Zero is a multitool for exploring and testing wireless and contactless systems. It contains a sub-1 GHz radio, an RFID reader and emulator, NFC, an infrared transceiver and Bluetooth Low Energy. People use it for penetration testing, hardware research, protocol development and radio tinkering, and it became widely known through online videos of users opening garage doors, ringing doorbells or copying access cards and digital keys.
That visibility had already caused trouble elsewhere. Brazil’s telecom regulator, Anatel, refused to certify the device, which led the national postal service to stop delivering it, and Amazon had stopped selling it.
The case against the ban
Flipper Devices published its response on March 19, 2024. Its central claim was that the Flipper Zero cannot steal modern cars, and that the tools thieves actually use are different.
- Rolling codes: Most car key fobs use rolling codes, which send a different encrypted signal every time the button is pressed. Recording one signal and replaying it later does not unlock the car. Only older cars with static codes, which the company said had been phased out about 20 years earlier, are vulnerable to a simple capture-and-replay.
- Relay attacks need different hardware: A common technique against keyless cars uses a pair of “repeaters” that relay the signal between a key inside a house and the car outside, fooling the car into thinking the key is nearby. Flipper Devices said these devices have four radio modules and sell on criminal sites for about €5,000 to €14,000. The Flipper Zero has one sub-1 GHz radio module.
- Security through obscurity fails: The company argued that the real weakness was outdated car access systems, and that banning a research tool would not fix them.
The company urged supporters to sign a petition and contact their members of Parliament, and pointed to SaveFlipper.ca, a site run by Canadian community members.
The Electronic Frontier Foundation made a broader version of the argument. General-purpose security tools are how researchers find the flaws manufacturers need to fix, it said, and restricting them leaves the public less safe. EFF also said that more than a year after Brazil’s action, it could not find a single confirmed case of a car stolen with a Flipper Zero.
| Flipper Zero | Keyless relay “repeater” kit | |
|---|---|---|
| Main purpose | Security research, testing, hobby use | Relaying a key fob signal to a car |
| Sub-1 GHz radio modules | One | Four, split across two units |
| Defeats rolling codes by replay | No | Not needed: it relays the live signal |
| Typical price cited | Consumer gadget pricing | About €5,000 to €14,000 |
Hardware and price details as described by Flipper Devices (March 19, 2024).
The case for the government’s concern
Critics were right that the Flipper Zero is a poor tool for stealing most modern cars. But the government’s underlying worry was not imaginary. Auto theft really had surged, organized groups were exporting stolen vehicles in large numbers, and wireless attacks on keyless entry are a real technique. Restricting purpose-built theft devices, such as the relay kits Flipper Devices itself described, is a reasonable policy goal. The problem was naming a widely sold research tool as the example, rather than the equipment thieves rely on.
What happened next
On March 20, 2024, Innovation, Science and Economic Development Canada (ISED) told PCMag that it would not ban the device outright. Its aim, it said, was “to restrict the use of devices like Flipper Zero to only legitimate actors,” and it said it was working with retailers and the auto industry and expected to announce concrete plans. Reports at the time said licensing purchases was one option under consideration. Flipper Devices said it supported the update, though it was unclear how such a restriction would work technically.
EFF criticized even the scaled-back version, arguing that a legitimate-users-only approach still treats ownership of a general-purpose tool as suspicious. Other jurisdictions took similar positions; police in Queensland, Australia, warned that owners might face questions about why they carried one.
- Early 2023
Brazil’s Anatel refuses to certify the device, blocking deliveries - February 8, 2024
Canada announces it will pursue a ban on devices that copy keyless entry signals, naming the Flipper Zero - March 19, 2024
Flipper Devices publishes its response and promotes a petition and SaveFlipper.ca - March 20, 2024
ISED says it will restrict the device to legitimate users rather than ban it outright - March 28, 2024
EFF argues that restricting the device harms security research
How to protect a car with keyless entry
Whatever the fate of any one gadget, keyless cars remain targets. These steps are widely recommended by police and insurers:
- Block the fob’s signal at home. Store keys in a signal-blocking (Faraday) pouch or metal box, and away from doors and windows, to defeat relay attacks.
- Check your car’s settings. Some vehicles let you turn off passive keyless entry, and some fobs have a sleep mode. Your owner’s manual or dealer can tell you.
- Add a visible physical deterrent, such as a steering wheel lock.
- Park in a locked garage or a well-lit, monitored spot when you can.
- Install software updates for your vehicle when the manufacturer offers them, since some address security weaknesses.
- Ask about tracking and immobilizer options from your dealer or insurer, which can help with recovery.
The bottom line
Canada’s Flipper Zero episode showed how a real problem can lead to the wrong target. Auto theft was surging, but the device the government named was not what thieves typically used, and the government revised its plan within six weeks. The more durable fixes lie with carmakers improving keyless systems and with enforcement against the organized networks moving stolen cars.
Sources
- Public Safety Canada: Government of Canada hosts National Summit on Combatting Auto Theft
- Flipper Devices: Response to the Canadian government
- GIGAZINE: Canadian government backs off Flipper Zero ban (citing PCMag)
- Electronic Frontier Foundation: Restricting Flipper is a zero accountability approach to security
- Cybersecurity News: Flipper Devices responds to Canadian ban
Top image: "Remote central locking" by James086, CC BY-SA 4.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments