Data centres face security risks amid growing strategic value: CSIS

Data centres in Canada will be of growing economic and strategic importance in the years ahead, but will also draw increasing security concerns to counter cyberattacks, supply chain risks, and potential threats from foreign governments, says an assessment by the Canadian Security Intelligence Service (CSIS).

The five-page partly-redacted assessment, labelled as “secret,” is dated May 27 of this year and was acquired through the access to information process.

It describes data centres as being “crucial” for national security in how they protect sensitive information, maintain data sovereignty, and support economic growth and stability, drawn by Canada’s cool climate, renewable energy, and proximity to the U.S. market.

Artificial intelligence (AI), cloud computing, and advances in digital computing are likely to increase that importance, the document states, but will also bring along a series of potential security risks.

“It is essential to consider a broad range of risks beyond simply cyber threats, including supply chain risks, as well as the risks associated with third-party vendors and service providers,” it states.

“As the Canadian data centre market continues to consolidate and grow, individual data centres will likely become increasingly critical to the country’s digital infrastructure.”

The assessment cites foreign ownership as ranking among those risks, including companies from China “seeking to capitalize on improved trade relations.”

“While foreign and domestic investments are primarily driven by commercial interests, investments can also pose national security risks if made by entities vulnerable to coercion or exploitation by foreign adversaries.”

Those could also include the numerous vendors, contractors, and third-party service providers needed to construct and maintain the data centres which the document describes as being a “complex and multifaceted process.”

The authors also note that data centres can be targets for cyberattacks, but also armed or military physical threats.

They cite Iranian attacks on Amazon data centres in the United Arab Emirates and Bahrain, as well as American and Israeli forces targeting a data centre belonging to Iran’s state bank, with that attack reportedly disrupting salary payments to some military personnel.

More recently, Russia targeted a Kyiv data centre in a Friday attack that killed four people, with Ukrainian President Volodymyr Zelensky saying the attack affected people’s ability to “stay connected, study, work.”

The document also cites the importance of supply chains to data centres, including a Bloomberg report that more than half of data centres planned for the U.S. this year are expected to be delayed or cancelled, in part due to shortages of electrical equipment such as transformers, switchgear, and batteries.

“Supply chain vulnerabilities are another significant threat vector that extend beyond simply the need (for) advanced semiconductors,” the document states.

“These complex systems also rely on stable access to semiconductors, cooling systems, and other critical electrical components.”

As of May, there were approximately 300 data centres operating across Canada, with that market expected to more than double in the next five years up to US$25 million.

The Alberta government has been a keen proponent of large-scale centres with several in the planning stages including a Meta AI facility north of Edmonton, an AI centre near Olds, and the Wonder Valley project near Grande Prairie.

There are currently five large-scale data centres of at least 10 megawatts operating in the province of Alberta. None of them currently run AI workloads.

In an interview, Alberta Technology and Innovation Minister Nate Glubish said he is familiar with potential security concerns that come with data centres, but also noted the increasing importance of data sovereignty.

“We don’t want to be completely dependent on infrastructure that is outside of our jurisdiction, and that other jurisdictions can literally flip a switch and turn it off on us if things aren’t going well,” he said.

“The home run for Albertans and for Canadians is building to attract Alberta-based companies and Canadian-based companies who want to build truly sovereign computing infrastructure.”

He said foreign companies who build data centres in Alberta would have to follow provincial and federal laws and privacy rules, adding that foreign-owned data centres wouldn’t necessarily have more data on Albertans.

“They’re only going to have records on people who use their services, and the use of those services will be governed by Canadian law for Canadian users, and will be governed by Alberta law for Alberta users.”

The office for federal Artificial Intelligence and Digital Innovation Minister Evan Solomon said in a statement that Ottawa works with the Canadian Centre for Cyber Security to ensure federal government information remains secure.

“Canadians should not have to choose between innovation and safety. They deserve both.”

York University criminologist professor Natasha Tusikov said in an interview that potential risks remain related to foreign storage of Canadian data, including from the United States who she said has a track record of being aggressive on behalf of its tech companies.

“If this is provincial, municipal, federal government data, what are the additional safeguards to make sure that it is protected and that it doesn’t touch in any way an American company?”

She added, “I would hope it would have extra special protections attached to it,” and added the same concern applied to the personal information of Canadians.

She added that Glubish is right to stress the need for Canadian companies to store domestic data, but also noted that as of right now, there are no such companies able to do so at the required scale.

“Maybe some of this data should only be stored in Canada, only accessible to Canadian law enforcement or Canadian taxation or statistical agencies,” she said.

“In some cases, it’s thinking differently about how data centres are designed and operated.”