CIRA: Canadians Connected, Discussing Digital Soverignty

This past week I attended CIRA’s¹ Advancing the conversation on digital sovereignty at Canadians Connected: Winnipeg, held at the Canadian Museum for Human Rights. The featured event was a panel discussion on Canadian digital sovereignty. The event itself was fine, the topic was timely and important, but one of the panel participants somewhat killed the vibe for me. It wasn’t just that she failed to read the room completely, but that she seemed to misunderstand what issues digital sovereignty was intended to address both for Canada and for the EU. She seemed to think that digital sovereignty was tantamount to an unwinnable declaration of war on the USA. It’s neither a war nor unattainable.

Failing to read the room is when you tell a group of tech nerds that databases are boring, infrastructure is boring, writing software is kind of pointless, and data is just a construct that has no value. While Bianca Wylie kept returning to her support for putting more fibre in the ground (Canada needs more east-west fibre routes), she said we should accept that our platform technology comes from the USA or China and leave it at that. Fundamentally, this misses the point about the importance of digital sovereignty, to the extent that I wondered how she’d gotten on the panel. Despite a resume that suggests she’s a fit for the discussion, she seemed to leave the other panelists, the moderator, and most of the room speechless on more than one occasion. I don’t disagree with her wanting to spend on community and social issues, but it’s a logical fallacy² that a government can’t do more than one thing.

What Digital Sovereignty Is

As an owner of a Canadian hosting company that has always maintained 100% Canadian data residency, I look at digital sovereignty as an idea that’s been excruciatingly slow to hit the mainstream as a goal of any real importance, but now it’s here and it needs to be taken seriously as a high-priority goal. A recent opinion piece says “Europe is starting to break up with US big tech. But it’s still abiding by the Silicon Valley rulebook”, citing “systematic underenforcement” of EU regulations as an issue. The piece recaps some non-theoretical examples of the dangers of ceding digital sovereignty, including last year’s ICC debacle and Anthropic Pulling Mythos 5 and Fable 5 in response to the Trump Administration’s ban on foreign access to them. It’s not a stretch to assume that competitive and economic concerns could see an IPO-eyeing Anthropic open those models to domestic customers only. I’d add the example of John Deere tractors ‘bricked’ after Russia steals machinery from Ukraine, where although a clearly good result was achieved, it was done through corporate exercise of political will across foreign borders. The result goes well beyond economic sanctions — in fact, it could make sanctions retroactive, leaving you to ask if you ever really owned the equipment you paid for. Cory Doctorow calls this “enshittification”,³ but it’s got implications for digital sovereignty as well.

In a nutshell, digital sovereignty is the ability for a state (government), organization, or individual to control their digital infrastructure, including technology, software, systems, physical infrastructure, and data (including privacy) to ensure its secure and autonomous operation without ceding control or reliance to another party. As one government source puts it, “The Government of Canada (GC) must be able to manage and protect its data, systems and infrastructure to operate securely and independently in a globally connected environment.”⁴ Circling back to John Deere, Apple, and the right to repair,⁵ this is where enshittification can extend to a nation’s digital sovereignty by impairing or removing their self-determination over the use of their digital technology.

In short, digital sovereignty is a risk mitigation strategy that no nation or enterprise can afford to ignore.

CIRA & Digital Sovereignty

To be clear, I’ve supported CIRA’s work from the beginning, and continue to do so. A single person’s ill-founded remarks at a single event won’t change that. CIRA will need to do more work behind the scenes to amend Bill C-22 before it becomes law though. This will affect digital sovereignty, since it creates a difficult environment for Canadian tech firms, despite Bianca Wylie’s assertion that when the government both legislates limits and promotes economic growth, the economic mandate will win out over the legislative limitations. Even Apple and Google argue that C-22 weakens privacy protection in Canada by going further than Canada’s allies do with their similar legislation. CIRA President & CEO Byron Holland stated that Bill C-22 was not expected to pass in its current form, but C-22 did in fact pass the third reading that same day and was sent to the Senate for review, thanks to some procedural pushes to block further amendments to it in what Michael Geist called an abrogation of democratic norms. The other day, he noted the federal government had “lost its way” based on what I’d call a false dichotomy deja vu that attempted to suggest that not passing C-22 as-is was a direct opposition to law enforcement; it’s clearly not.

Registering Your Support

I’ve signed Petition e-7416, which Canadians can do as well. (Watch for an email after you sign, as you have to confirm your signature from the email.) The EFF is watching the situation, and links to some good resources for learning more, including at Open Media and the Canadian Civil Liberties Association; the CCLA also opposes C-22. There’s a lot of opinion and analysis to read up on why Canada should keep its data out of U.S. hands, but remember that the responses like “but nothing bad is happening” and “I’ve got nothing to hide” ignore the future risk of the misuse of bills like C-22. You could argue that currently in the USA, existing legislation is being stretched beyond how it was intended to be applied. This trend reveals the risks inherent in bad legislation that relies on widespread “Oh, but they wouldn’t actually…” sentiment rather than formally restricting authoritarian uses, even from non-authoritarian governments.

Situations and circumstances change, which is why issues like privacy and digital sovereignty need to be established well in advance of an unforeseen scenario in which we need to depend upon them. The EU gets it, and Canada needs to take their cue on this one.

1. CIRA is the Canadian Internet Registration Authority, which responsible for the .ca CCTLD, and has expanded its mandate to other internet concerns in Canada.↩
2. A false dichotomy forces a choice between two options that may not be mutually exclusive and may not be the only available options. These tend to come down to “You’re either for us or you’re agin’ us!” to force a binary selection from a non-binary list of options. This will come up again below.↩
3. See About those kill-switched Ukrainian tractors↩
4. Digital Sovereignty: A Framework to improve digital readiness of the Government of Canada; see also Digital sovereignty (Canada.ca); How Canada could achieve digital sovereignty (May 2025); in the EU context, Digital sovereignty for Europe (PDF), European Parliamentary Research Service; Strengthening Europe’s Tech Sovereignty, European Commission; Digital Sovereignty (Linux Foundation); You’ve got to fight for the right to policy., IE University; and more generally, Digital sovereignty (Wikipedia). It’s no accident that meaningful discussion on digital sovereignty tends to take place almost exclusively outside the USA, in regions where there is growing discomfort with finding American laws creating unacceptable risk, or of already negatively impacting them. In short, these would constitute a loss of digital sovereignty.↩
5. For more, see Canada’s Competition Bureau and CanRepair. Some provinces like Ontario and Manitoba are considering their own legislation.↩