OTTAWA — American hyperscalers can be trustworthy holders of critical Canadian data, IBM Canada’s chief technology officer says—an idea that he believes he’s persuading governments to adopt.

Political leaders’ views on what digital sovereignty means are “maturing,” after months of discussions about what assuring the sovereignty of Canada’s data and key digital systems really means, says Manav Gupta.

“Sovereignty does not equal solitude,” Gupta says, echoing a phrase much employed by AI Minister Evan Solomon. In an interview with The Logic, Gupta will use variations of the expression four times.

Since U.S. President Donald Trump’s started threatening Canada’s independence and attacking its economy, governments have been struggling with how to make sure critical digital systems aren’t vulnerable to a sudden presidential whim to shut them down or crack them open and see what Canadian secrets they might contain.

For cloud-computing providers that do business with the Canadian government, including IBM, that’s meant rushing to convince leaders that their services are as secure from foreign government intrusion as Canadians could want.

It’s been a slog, says Gupta. “The belief was ‘sovereignty’ means ‘sovereign right down to the grain of sand that goes into a chip,’ which probably is a step too far.”

Canada can’t manufacture, assemble and operate every component in a data centre that runs even the most important government systems, and developing all those capabilities isn’t realistic, he says.

The government itself acknowledged as much in an October position paper on digital sovereignty: “It is impossible for the [Canadian government] to obtain a state of complete digital sovereignty, known as digital autonomy, due to the absolute interconnected nature of the digital world,” the paper said.

What appropriate protections do look like is harder to say, though, especially when one of the most worrying threats is from the country that’s home to the world’s largest cloud computing companies.

Gupta, a “loud and proud Canadian,” has been IBM Canada’s chief technology officer since 2021, and he’s also loud and proud about that. The company’s deep roots in Canada differentiate it from Google or Amazon, he says: “We are unlike other hyperscalers or other digital giants.”

IBM has been in Canada for more than a century—its Canadian subsidiary was the first part of the company to use the name “International Business Machines”—and employs thousands of people in more than a dozen Canadian offices and labs. It has a key semiconductor plant in Quebec, the largest of its kind in North America.

But it’s still an American company, subject to American law. That includes the CLOUD Act, which entitles U.S. authorities to data held by American tech companies, no matter where in the world it happens to be kept.

Keeping Canadian data in Canada is table stakes, in Gupta’s view, but by itself data residency—where the servers physically are—is an “infantile way of thinking about sovereignty.”

IBM can build cloud services that the company itself couldn’t get into without Canadian authorization, Gupta says. Data can sit on IBM servers but be protected by encryption to which IBM doesn’t have the keys. The United States—or another government—could demand it, but so what?

“If they do not have the means to decrypt the data, that data becomes worthless,” he says.

Microsoft president Brad Smith visited Canada in December to make his own company’s pitch for Canadians’ trust, which included the option of encrypting customer data even while Microsoft servers are crunching it and a promise to “challenge any government demand for Canadian government or commercial customer data where we have a legal basis for doing so.”

Gupta goes a step beyond, saying IBM can offer systems that are part of its global cloud but that can be severed from it on command.

A customer, like the federal government, can “effectively have an air-gapped environment that no other nation-state, no other foreign actor, can touch,” but only when that customer needs it, Gupta says.

Permanently isolating data centres from the rest of the internet is very possible—and appropriate for the most sensitive systems—but it means giving up many of the benefits of cloud-based computing, Gupta says. Those include economies of scale, redundancy, having extra computing power available when it’s needed and constant attention from some of the best technical people around.

That’s the core problem the government, like any entity holding masses of important data, has to contend with. The more separated from the global cloud a system is, the more resources the owner has to put into operating it and the less resilient it’ll be, Gupta says: “Ultimately, sovereignty or exclusion is going to come at the detriment of the business model.”