← Listen againIn Conversation
Who Controls the Data in Foreign Military Software? November 7, 2026 · 5:49 · With Maya, Leo, and Daniel
We look at one subject from different angles, using clear English to understand the world.
Transcript Maya Welcome to Slow English FM. I’m Maya, and this is our round table. We look at one subject from different angles, using clear English to understand the world. Today’s question is: when a country uses foreign software for its military, who controls the data, and how much does the country depend on the company that provides it? With me are Leo, our columnist for technology and digital life, and Daniel, our columnist for world affairs, conflicts and elections. Leo, what is Canada using, and what is the software meant to do? Leo Canada’s Department of National Defence has had a contract for Gotham, software made by the U.S. company Palantir, since 2020. Gotham brings together information from military databases, so users can look for links and patterns across large amounts of information. It runs on closed, classified networks in secure facilities in Canada. The contract was first valued at 14 million dollars and could reach 63 million. The department has not said exactly what information the software processes, citing national security. So we know the broad purpose and the setting, but not the specific data it handles. Maya Daniel, why does the location of the data matter if the system is kept in Canada? Daniel Because where data is stored is only part of the question. Barry Appleton, an international lawyer who practises in Canada and the United States, says the U.S. CLOUD Act allows authorities with proper legal process to require covered U.S. companies to provide data they possess or control, wherever it is stored. The Canadian defence department says its assessment found that government data, prompts, outputs and metadata handled under the contracts could not be stored, accessed or processed outside Canada. It also says the law has no authority over servers in Canada. Appleton disputes that reading. Daniel His point is that the law focuses on whether the company controls the data, not where the server sits. Maya Leo, can you put that difference in simple terms? If the servers are in Canada, how could the company still be asked for data? Leo DND says its assessment found that government data handled under the contracts could not be stored, accessed or processed outside Canada. Appleton says the law can reach data a U.S. company possesses or controls, wherever it is stored. The department has also declined to explain the exact information Gotham handles. So the key question is not only the server’s location. It is also who can control or reach the information stored there. Maya Daniel, beyond legal access, what does dependence on one foreign supplier mean for a country’s military? Daniel It means a country may rely on an outside company for technology that is difficult to replace. Vass Bednar, a policy researcher at the Canadian Shield Institute, warns that relying on an outside supplier for critical digital infrastructure could create a digital dependency and weaken Canada’s control over it. That makes the supplier relationship part of the question of control, even apart from the legal debate over data. Leo That is where the available alternatives matter. Technology policy researcher Jennifer Evans points to two Canadian companies, Caseway and Anvil. She says their software does not yet match the breadth and depth Palantir offers, and that it would take time to develop comparable technology. In practical terms, the military may have a broad tool now, while domestic suppliers still need time to build comparable systems. Maya Daniel, what choices does that leave for Canada? Daniel The reporting points to two different time scales. In the short term, DND says its assessment found that government data handled under the contracts could not be stored, accessed or processed outside Canada. In the longer term, Bednar argues that Canada should invest in building and owning this kind of defence infrastructure at home. The challenge is balancing an immediate tool with the ability to make independent choices later. Evans says Canadian alternatives would need time to develop technology with comparable breadth and depth. Maya Leo, one security measure Evans mentions is air-gapping. What does that mean, and why does it matter here? Leo Air-gapping means separating a computer or network from the internet and other unsecured networks. Evans says the department should disclose whether the contract uses it. Maya So the central question is not simply whether the servers are physically in Canada. It is also who can control the data, and whether Canada can replace the supplier if it needs to. Daniel has brought out the legal and national-dependence questions. Leo has explained the software, the security measures and the limits of current Canadian alternatives. Thanks for listening to Slow English FM.
