On Digital Sovereignty, It's Time to Walk the Walk

26 August 2026

CIRA, the Canadian Internet Registration Authority, is the organization in charge of managing the .CA Internet domain. Its website proclaims "We are Canada's internet" and it has run several articles and surveys on digital sovereignty, as well as holding a meeting on the topic in Winnipeg recently. Sounds great!

There are a few problems, though. CIRA's email is hosted by Microsoft using its Microsoft 365 platform. CIRA's customer relationship management and ticketing system is hosted by Salesforce, a US company. CIRA uses Cloudflare (another US company) as a content delivery network in front of its web site.

And based on some Domain Name System (DNS) records published by CIRA, it seems that CIRA currently uses, or has in the past used, services from OpenAI, Slack, and Google (all large American companies) as well as Zoho (an Indian company) and Atlassian (an Australian company known for an issue-tracking system called JIRA.)

When an organization that calls itself "Canada's internet" and claims to support digital sovereignty is so heavily reliant on non-Canadian products and services, how are other Canadian organizations supposed to take it seriously?

And let's not forget the Federal Government itself. Most government email is also hosted by Microsoft. I certainly hope that government officials do not use email for anything sensitive; does anyone seriously think for one second that if the US administration demanded data from Microsoft that Microsoft would refuse to comply?

And why is it that every time a Canadian citizen emails their MP, that email passes through the Ironport email servers of Cisco, an American company?

Digital Sovereignty is a Matter of National Security

As I write this (2026-08-24) trade talks between Canada and the USA have broken down over unreasonable last-minute demands by the USA. Does anyone seriously believe that the United States, whose leader has mused multiple times about annexing Canada, will not use every lever at its disposal to coerce Canada and other countries? Our almost total reliance on American software and digital services is a giant lever that can be pulled any time to devastating effect. With a single stroke, the United States can disable our government, our banking, our infrastructure—everything.

It's time to stop talking about digital sovereignty and time to act. Email is the low-hanging fruit. Email is very easy to host, and indeed, self-hosted email was the norm for the first 30 or more years of the Internet. Open-source email programs like Postfix and Cyrus IMAP have been used successfully to host large numbers of mailboxes.

Virtually all services like Slack, Salesforce, and Atlassian have free open-source alternatives that can be self-hosted, and Canada certainly has people with the skills to do it. Taking control of our data is the first step to digital sovereignty. On this front, Europe is leading the way and starting to replace Microsoft services and software, having been burned by Microsoft's unilateral canceling of an ICC official's work email account.

Next, we need to examine and drastically cut back the widespread use of Microsoft Windows in Canada. This closed-source operating system is controlled by a US company. Imagine the ramifications if a hostile US government demanded that Microsoft no longer supply security updates to Canadian installations. Our infrastructure would be at the mercy of any number of bad actors.

For this reason, Canadian organizations need to urgently plan to migrate away from Microsoft Windows. The obvious replacement is Linux. Apple's Mac OS is not an alternative, being just as problematic as Windows because it is controlled by a large US tech company and is closed-source.

Although many Linux developers live in the United States, many others do not. And Linux is open-source, so Canadian security experts can examine the code to look for any nefarious code that attackers might try to introduce. Finally, the United States cannot cut Canada off from security updates because we can obtain them from other countries, or simply have our own Linux experts fix any problems.

"But It is Impossible!"

At this point, I suspect many readers of this article are fairly quivering with objections as to why everything I suggest is impossible. Well, I know it's not impossible because I did it. For 19 years, I ran a successful software company in Canada and ran it completely on open-source software. We did not use any software or services from Apple, Microsoft, Google, Salesforce, Amazon or any similar tech companies. [Full disclosure: We did try Salesforce for a year, but the costs were so high we ditched it in favour of an open-source alternative.]

Our annual software licensing budget was $0.00 and the savings allowed us to competitively price our software and services.

To CIRA, to the Government, to all Canadian organizations, I say this: Digital sovereignty is an urgent matter of national security. Stop talking and start doing.