The CLOUD Act gap in Canadian defence infrastructure · Northfleet<br>Skip to main content<br>Every meaningful managed Kubernetes service available to Canadian buyers (Red Hat OpenShift, AWS EKS and GovCloud, Azure AKS and Government, Google GKE) is operated by a US-incorporated vendor. Every customer workload running on one of those services is therefore exposed to the 2018 US CLOUD Act regardless of physical data residency in Canada. That posture was a tolerated technical compromise until February 2026, when Canada’s Defence Industrial Strategy named Secure Cloud as a sovereign capability and committed 70% of defence procurement to Canadian-controlled firms. What was previously an architectural footnote is now a procurement-evaluation criterion.

Every meaningful managed Kubernetes service is operated under foreign legal authority

“Operated by” carries a specific procurement meaning. The vendor’s engineers hold administrative access to the control plane, ship updates to the running software, debug incidents under their own corporate governance, and answer to the regulators of the country where the vendor is incorporated. Each of the four services named above (OpenShift, EKS and GovCloud, AKS and Government, GKE) meets that definition with a US-incorporated vendor in every case.

The hyperscaler “government” variants are the most common procurement misunderstanding. AWS GovCloud and Azure Government are partitioned environments with stricter access controls, US-personnel requirements, and FedRAMP High accreditation. They are still operated by US-incorporated subsidiaries of US-incorporated parent companies.12 The partition addresses US federal compliance requirements; it does not relocate the vendor outside US legal authority. A Canadian customer signing a contract for either gets the partition’s operational controls and the parent’s jurisdictional reach.

Red Hat OpenShift presents a different surface. Red Hat ships software the customer installs on infrastructure the customer operates, which makes “operated by” ambiguous at first read. The ambiguity resolves on inspection. Red Hat is a wholly-owned subsidiary of IBM, incorporated in Delaware, governed by US law.3 The OpenShift trust path, including the signing keys for the container images that compose the platform itself, resolves to a US-incorporated entity. The customer running OpenShift in their own data centre still inherits Red Hat’s jurisdictional posture for everything they pull from Red Hat’s registries.

A prime that runs upstream Kubernetes on its own Canadian bare metal is having a different conversation than a prime buying any of these services. That conversation is less common at the scale Canadian primes operate, and is addressed later in this piece.

What the CLOUD Act actually compels

The 2018 US CLOUD Act (codified as 18 U.S.C. §2713) is short and direct. It extends US warrant authority to compel US-incorporated providers of remote-computing services (the statutory category that covers cloud and platform vendors) to produce data in their possession, custody, or control, regardless of where the data is physically stored. The provider’s data centre might be in Toronto or Montréal; the warrant is served at the provider’s US headquarters and operates against the legal entity, not against the physical location of the storage. The statute makes no exception for foreign-citizen customers, foreign-government contracts, or contractual data-residency commitments.

A Canadian defence prime running classified workloads on a US-incorporated cloud platform is therefore one US warrant away from compelled disclosure of those workloads. The disclosure can be served on the provider with no notification to the Canadian customer or to any Canadian authority, and the provider can be obligated under a gag order to never disclose that the request occurred. Whether the disclosure has happened to any Canadian customer is, by design, unknowable from public records.

The most direct confirmation of the exposure came from Microsoft France in June 2025. Anton Carniaux, Microsoft France’s director of public and legal affairs, testified under oath at the French Senate. Asked whether Microsoft could guarantee that data of French customers stored in EU regions would not be transferred to US authorities under the CLOUD Act, his answer was “Non, je ne peux pas le garantir.” No, I cannot guarantee that.4

The Office of the Privacy Commissioner of Canada has held the corresponding position for over a decade: “no contract, no matter how well crafted, can override the laws of the foreign jurisdiction.”5 The Canadian Bar Association’s submission on the US-Canada CLOUD Act agreement recommends that any enabling legislation include mandatory Canadian-court review of US requests, an implicit acknowledgement that current arrangements lack it.6 Citizen Lab’s 2025 analysis of the cross-border surveillance regime reaches the same destination from the constitutional-rights...