Law Enforcement and Intelligence Infrastructure US Controlled, Amid the War
Minister Anandasangaree,
Prime Minister Carney has said Canada is at war with the United States. That changes how one fact should be read: the infrastructure Canada's own police and security agencies depend on is controlled by companies from the country we are at war with, and this is not limited to the RCMP.
Using public DNS and IP registration records, I confirmed that rcmp.ca is hosted directly on Microsoft Azure, and the RCMP's mail domain authorizes Microsoft 365 to send mail on its behalf alongside SSC's own servers. The pattern goes further across your own portfolio. CSIS's mail domain authorizes Microsoft 365 as its only sender, with no Canadian fallback at all. CBSA authorizes Microsoft 365, Amazon SES, and several raw Amazon IP ranges directly. Correctional Service Canada authorizes Microsoft 365 alongside SSC's relay pools. Even where a mail server physically sits on Canadian SSC infrastructure, as with the RCMP and CSC, the domain still hands sending authority to a US company.
None of this required special access. I used standard WHOIS, DNS, and IP registration lookups, all public by design. Confirming who actually owns the infrastructure behind a Canadian domain requires ARIN, the American registry responsible for IP allocation across Canada and the US alike.
If the US restricted access through the CLOUD Act, sanctions, or political pressure, records could become unreachable, not through an attack, but through a decision made in the country we are at war with. That is not abstract: in 2025, the International Criminal Court's chief prosecutor lost access to his own Microsoft email after a US executive order sanctioned him, through the ordinary reach of US law over a US company. It happened to an institution on EU soil and drew formal questions in the European Parliament. If the same happened here, it would not be a paperwork delay. It could mean someone with a record involving children is not flagged before they get access to a child. It could mean intelligence on a planned attack sits unreachable while the people planning it move ahead unwatched. CSIS having no Canadian fallback at all makes this the sharpest version of that risk.
I am not suggesting any of this should be hidden. It cannot be, and should not be. This is not a request for your opinion. You are the minister with actual authority over the RCMP, CSIS, CBSA, and CSC. Every one of them must run on Canadian owned infrastructure, with backups on Canadian servers, so none of this is reachable by a country we are at war with. I expect you to direct public confirmation of exactly which companies host this infrastructure now, and to bring forward the requirement for Canadian ownership and control across your entire portfolio.
I expect a response on what actions you will be taking, not an explanation about it being difficult.
Reann Legge
I use the pronouns she/her
reannlegge.ca