The Right Way for Canada to Secure Cloud Sovereignty

Ottawa is promoting a “sovereign cloud” as the next frontier of nation building. But as Lawrence Zhang writes in Policy Options, real sovereignty in digital systems isn’t about where servers sit—it’s about who controls access, who holds the keys, and who can say no when others seek Canadian data.

Zhang warns that building domestic server farms risks wasting billions on symbolism without improving security, control, or economic competitiveness. Instead, Canada should “build sovereignty into contracts and cryptography,” treating control over data the same way it treats control over defence technology:

• Procurement standards: Use enforceable rules to stipulate who can access sensitive workloads
• Canadian-cleared personnel: Require domestic oversight for classified or critical systems
• Encryption control: Ensure Ottawa alone holds encryption keys for government data

If Ottawa’s goal is control over Canadian data and its security, these measures provide the right levers. If instead the goal is economic development, policymakers should ask whether scarce public funds are better spent replicating global cloud infrastructure or investing in high-impact areas such as AI, quantum, and cybersecurity. Zhang cautions that trying to fuse these two goals into a single “sovereignty” initiative risks achieving neither, resulting in weaker security at higher cost and no real industrial payoff.

The lessons from abroad are clear: most governments have found that real sovereignty comes from partnerships with global providers that guarantee domestic control, not from building new homegrown cloud platforms.

Canada should follow suit. If the objective is control and security, hardwire it into contracts; if it is industrial policy, focus on sectors where Canada can truly lead. As Zhang concludes, “Real sovereignty is about control and leverage, not the logo on the server rack.”

Read the full commentary in Policy Options.