CSIS Just Said It Out Loud. Data Centres Are Targets.

Pillar 03 · Residency

Big news from CSIS this week. Data centres are valuable, so bad people might want them. Stop the presses.

To be fair, the Edmonton Journal story had a good line. Canadians should not have to choose between innovation and safety. They deserve both. Lovely. Now somebody tell me how, because the current plan looks a lot like hoping.

A data centre is a building. Fence, generator, cooling plant, fibre path, staff list. Every one of those is a door. Espionage. Sabotage. An insider with a badge and a grudge. A supplier with a helpful firmware update. CSIS has warned about all of this for years in every other sector. Data centres finally made the guest list.

And it’s already happened. In March, Iranian strikes took out two AWS data centres in the UAE and a third in Bahrain. Turns out the biometric scanner at the front door doesn’t do much against a missile. Who knew.

Then there’s the threat that doesn’t even need to break in. Last November the CSIS director said Canada’s data increasingly sits with foreign governments and their companies, under their laws, ready to be weaponized. Nearly a third of Canada’s data centres are American owned. No drones required. Just a court order and a polite request to comply. They always comply.

So what’s our answer? Build more Canadian data centres. Hang a maple leaf in the lobby. Issue a press release with the word sovereign in it three times. Done. Nation secured.

I’m all for the build-out. We need the capacity. But CSIS just told us the problem is high value targets with everything in one place. Our solution is more high value targets with everything in one place. Bold strategy.

Here’s the question nobody at the ribbon cutting asks. If someone gets in, what do they get?

Everything. The answer is everything. Encrypted, of course. With the keys held by the same operator, in the same building, answering to the same judge. That’s a locked diary with the key taped to the cover.

Credit where due. Treasury Board went to assume-breach on October 1. Good. Now let’s actually assume it. If the breach is coming, the only control that matters is the one that decides what the breach is worth.

That’s custody. Encrypt on the client before anything leaves. Split it into shards. Spread the shards across independent operators and jurisdictions. Keys stay with the owner. Now go ahead. Bomb a site. Raid it. Subpoena it. Bribe the night shift. Congratulations, you’ve stolen confetti. You can’t rebuild the file. Neither can the operator. Neither can the judge.

Lose a site and the data rebuilds from the others. Same design keeps it private and keeps it running. Funny how that works when you start with math instead of a lease.

So yes, keep using the hyperscalers. They’re very good at what they do. Keep building Canadian capacity. Just stop asking one building with a nice flag to be the entire national security strategy.

CSIS named the problem. The fix is architecture.

Sovereignty by architecture, not by promise.

Bias declaration. I run SkyeConnex. We sell data custody that doesn’t depend on any one building, operator or country behaving itself. Read accordingly.