Edmonton Journal has reported:

Canada’s data centres are expected to become more important to the economy and national security, while facing a broader range of risks that includes cyberattacks, supply chain vulnerabilities, physical threats and foreign government influence, according to a Canadian Security Intelligence Service assessment. The five-page document is labelled “secret,” partly redacted and dated May 27 of this year; it was obtained through the access to information process.

The assessment says data centres help protect sensitive information, maintain data sovereignty and support economic growth and stability. It points to Canada’s cool climate, renewable energy and proximity to the U.S. market as factors that draw investment, and says artificial intelligence, cloud computing and advances in digital computing are likely to increase the facilities’ importance.

The document urges officials to look beyond cyber threats when assessing security. “It is essential to consider a broad range of risks beyond simply cyber threats, including supply chain risks, as well as the risks associated with third-party vendors and service providers,” it states.

As Canada’s data centre sector consolidates and expands, individual facilities could become more vital to digital infrastructure, the assessment says. “As the Canadian data centre market continues to consolidate and grow, individual data centres will likely become increasingly critical to the country’s digital infrastructure.”

Foreign ownership is among the concerns cited, including companies from China “seeking to capitalize on improved trade relations.” The assessment says investment can create national security risks when an investor may be vulnerable to pressure or exploitation by a foreign adversary, even when the investment is primarily commercial.

“While foreign and domestic investments are primarily driven by commercial interests, investments can also pose national security risks if made by entities vulnerable to coercion or exploitation by foreign adversaries.” The risks may extend to the vendors, contractors and service providers required to build and maintain facilities, a process the assessment calls “complex and multifaceted.”

The authors also identify physical attacks as a possible threat alongside cyberattacks. They refer to Iranian attacks on Amazon data centres in the United Arab Emirates and Bahrain, and to American and Israeli forces targeting a data centre belonging to Iran’s state bank. That attack reportedly disrupted salary payments to some military personnel.

The assessment also points to a recent Russian attack on a Kyiv data centre on a Friday that killed four people. Ukrainian President Volodymyr Zelensky said the attack affected people’s ability to “stay connected, study, work.” The source account did not specify the date of that Friday attack.

Supply chain constraints pose another risk to data centre plans. The document cites a Bloomberg report that more than half of the data centres planned in the United States this year are expected to be delayed or cancelled, partly because of shortages of electrical equipment, including transformers, switchgear and batteries.

“Supply chain vulnerabilities are another significant threat vector that extend beyond simply the need (for) advanced semiconductors,” the assessment says. “These complex systems also rely on stable access to semiconductors, cooling systems, and other critical electrical components.”

As of May, about 300 data centres were operating in Canada. The market is expected to more than double over the next five years, up to US$25 million, according to the source account. Alberta’s government has supported large-scale facilities, with several projects in planning stages: a Meta AI facility north of Edmonton, an AI centre near Olds and the Wonder Valley project near Grande Prairie.

Alberta has five operating large-scale data centres, each with capacity of at least 10 megawatts. None currently runs AI workloads. Technology and Innovation Minister Nate Glubish said in an interview that he knows of the possible security concerns associated with data centres, while stressing the growing need for control over domestic data.

“We don’t want to be completely dependent on infrastructure that is outside of our jurisdiction, and that other jurisdictions can literally flip a switch and turn it off on us if things aren’t going well,” Glubish said. He said the preferred outcome for the province and country would be to attract local companies to build computing infrastructure under Canadian control.

“The home run for Albertans and for Canadians is building to attract Alberta-based companies and Canadian-based companies who want to build truly sovereign computing infrastructure.”

Glubish said foreign companies building data centres in Alberta would have to comply with provincial and federal laws and privacy rules. He also said foreign ownership would not necessarily mean a facility held more information about Albertans, because its records would concern people who use its services.

“They’re only going to have records on people who use their services, and the use of those services will be governed by Canadian law for Canadian users, and will be governed by Alberta law for Alberta users.”

The office of federal Artificial Intelligence and Digital Innovation Minister Evan Solomon said in a statement that Ottawa works with the Canadian Centre for Cyber Security to protect federal government information. “Canadians should not have to choose between innovation and safety. They deserve both.”

Natasha Tusikov, a York University criminologist professor, said in an interview that storing Canadian data abroad carries risks. She cited the United States’ track record of acting aggressively on behalf of its technology companies and asked what extra safeguards would apply to provincial, municipal or federal government information stored in a way that could involve an American company.

“If this is provincial, municipal, federal government data, what are the additional safeguards to make sure that it is protected and that it doesn’t touch in any way an American company?” Tusikov said. She added, “I would hope it would have extra special protections attached to it,” and said the same concern applied to Canadians’ personal information.

Tusikov agreed with Glubish’s emphasis on Canadian companies storing domestic data, but said no such companies are currently able to do so at the required scale. She suggested some information might be kept only in Canada and accessible only to Canadian law enforcement or Canadian taxation or statistical agencies.

“Maybe some of this data should only be stored in Canada, only accessible to Canadian law enforcement or Canadian taxation or statistical agencies,” she said. “In some cases, it’s thinking differently about how data centres are designed and operated.”

Related coverage cited in the source includes a report that Alberta power prices could spike because of Meta’s data centre, a claim the company disputes, and a County of Grande Prairie development permit for a data centre near Sexsmith. The source also listed the contact mblack@postmedia.com and invited readers to bookmark EdmontonJournal.com and EdmontonSun.com, sign up for newsletters and become digital subscribers. It said subscribers receive unlimited access to The Edmonton Journal, Edmonton Sun, National Post and 13 other Canadian news sites.