REBOOT: The Trust Advantage: How OpenText is Securing Canada’s Information Layer

Speaker A: Hi, it's John here. This summer on Disruptors, we're highlighting some of our favorite conversations from seasons past. So stay tuned to hear more from some of Canada's leading minds in technology and innovation. And if you want to learn more about these ideas, check out our show notes and get everything delivered straight to your inbox. From all of us at Disruptors, we hope you're having a wonderful summer.

Speaker B: HEC sovereignty would guarantee Canadians that their core services and core data that are essential to the functioning of Canadian society are free from coercion by outside powers. That matters in a world where great power competition is back. And even more surprising, our neighbor to the south, which has been a trusted partner for so long, is no longer. Our cyber protections inside government are, uh, among the best in the world. The encryption that protects the most fundamental government data, which other governments would like to access, the core health data that is so important to people in this country, as well as the, uh, data that is embedded in core financial services. These are all things that affect Canadians every day of their life. And we cannot take the risk that any outside power could use access to that data to coerce us.

Speaker A: That's Janice Stein of the Munk School of Global affairs and Public Policy at the University of Toronto. She's a leading Canadian voice on security and tech governance. You just heard her define tech sovereignty plainly. Keep core services and data free from coercion.

Speaker B: We have to bring the private sector to the table with our government to work together and make decisions. What are the core things that we need to protect from coercion? And then we need to fund some infrastructure that will be ring fenced with the consensus of Canadians and with the active participation of, uh, the people who make the tools that's in the private sector, the people who use the tools, those are Canadian companies and Canadians and those who insure the tools. And that's our government. We all have to share a sense of urgency and in a world that is just not friendly to Canada in the way that it was.

Speaker A: I'm John Stackhouse. Welcome to Disruptors, the Canada Project. This season we're crisscrossing the country to meet the builders, using technology to tackle Canada's toughest problems and along the way, sketch a, uh, blueprint for a stronger, more competitive nation. Today's destination, Waterloo, Ontario. For decades, this region helped Canada wire the world for secure mobile communications. Think back to research in motion, aka BlackBerry, setting the bar for enterprise grade trust on a global scale. Back then, most of us pushed far less data as a sense of scale. In 2003, global Internet traffic was about 0.8 exabytes per month. Today, estimates suggest roughly 0.4 zettabytes of data are created every day. I'll save you the math. That's about 500 times more every day than a whole month in 2003. And a lot of that flood is because of AI. Different measures, same signal. We're operating at a completely new scale now.

Speaker C: Moving.

Speaker A: Most people hear AI and think chatbots and productivity. They also know it takes a lot of data centers to power up. And Canada is building them, backed by clean power and billions in investment. But that's not the whole story. Here's something we all might take for granted. The real stakes are one layer down, our information layer. Who can see our data, where it lives, and whether the rules are enforced in code under Canadian law. Our peers are already baking sovereignty into their tech stacks. Govern data residency, auditability as, uh, standard practice. Now we're catching up, but we can leapfrog. Our guides today are Tom Jenkins and Shannon Bell of OpenText, a Waterloo born globally deployed tech champion. For 35 years, their teams have helped enterprises and governments govern data, encode policy, and keep critical systems running even on bad days. In their world, the product is trust. Keys we hold, rules we encode and proof we can show. So Canadian organizations can scale AI under Canadian rules and export that standard to allies. Tom and Shannon, welcome to Disruptors.

Speaker D: Thank you.

Speaker E: Great to be here.

Speaker C: Tom, I want to start with this question of tech sovereignty. You are one of Canada's leading thinkers and voices on this, have been for many years. What does tech sovereignty mean to you?

Speaker E: Tech sovereignty just simply means your ability to control your environment. So in the case of sovereignty, in the analog world, that would mean control of your borders, control of the oceans that we live adjacent to. So in tech, it just simply means control of your technology environment.

Speaker C: I think we used to call it resilience, and we all had backup clouds, backup systems, because things break. But now there's kind of a new challenge to resilience, which is foreign interference and wanting to have our own tech infrastructure while also working with and integrating with other tech infrastructures.

Speaker E: That is the downside of globalization. We've all benefited throughout the world with globalization, but with globalization comes the ability to communicate things, whether it's Covid or SARS or whatever. The reality is, when we're part of the global community, we have to exist with both the good and the bad.

Speaker C: Shannon, you build a lot of this stuff. How hard is it? For Canada and for Canadian companies, to build our own tech stacks versus working with those global platforms that were in some ways an extension of that globalization era.

Speaker D: It's a little bit like back to the future. So for years and years, for decades, we had to build data centers and infrastructure to run applications. And that was part of how every company ran. And with the advent of cloud services, it became very easy to leverage those services to drive faster paths to market. And in the discussions around sovereignty, it's really, what do you need to control and why? How do you protect your data? And increasingly, data is becoming a differentiator for companies and for businesses. And so what are the pieces in the technology stack that are going to enable a business to differentiate themselves? And therefore those are the pieces that you need to control.

Speaker C: And data is the essential input to AI. So as everyone thinks about AI, how it's transforming our lives, but every business as well, take us further into that, uh, for sure.

Speaker D: So data is really, as you said, the power or the fuel for AI. And if you think about an enterprise, 90% of their data is sitting behind their firewalls, not in the public domain. And so with the advent of AI, it's been trained on everything that's publicly available and that's being leveraged today through tools like ChatGPT and otherwise in the consumer domain. But from an enterprise business perspective, it really is all of that data that they've accumulated over decades that is enabling them to identify and pinpoint trends, train AI models to drive intelligent agentic behavior that is helping them differentiate their business in the global market. So it's really about that data set, how businesses are using it to leverage what and what amount of that data they're comfortable having in the public domain versus wanting to control it in a sovereign cloud type of environment. And so that's really the discussion point.

Speaker C: I might have thought of data as kind of a global phenomenon. My data lives, it transcends borders. But listening to you and others, I'm getting the sense that there are perhaps national boundaries around data and there may be more of that. Is that how we're going to think of the future of a bit more nationalistic or data within borders approach?

Speaker E: Well, we've actually already thought that way. There's something called gdpr, which is the General Data Protection Regulation. It first arose, oh, about 15 years ago as people started to realize, uh, it might not be a good idea to put somebody's health results on the public web, or to put their bank account or their tax form. People started to realize that even things like open government which on one hand sounds like a really good idea, is actually not such a good idea if you can figure out which patient is for which doctor, you know, in Sault Ste. Marie. And so data and data sets became a big point of, um, focus for public policy about 15 years ago. And so this idea of GDPR basically started to say, if you have somebody's information, then within that legal jurisdiction, so say in the case of Canada, that information's got to stay in Canada, can't go outside of Canada. It has to be run on Canadian servers and it has to be monitored, managed, governed, controlled, secured by Canadians. It allows a government within their jurisdiction to assure their citizens that the data is being protected, that there is good governance, it's orderly, and, you know, some international player is not going to run off with your data. Data is sort of the stuff you put up in your attic in a box and you go get your records when you need it, or you go get your photo album when you need it, and that sort of thing. AI, well, that's like being broadcast in the middle of a movie theater in a shopping mall. You know that it's highly, highly public. And so GDPR is now starting to be adapted to deal with things like artificial intelligence.

Speaker C: But Tom, do those rules transcend easily into the age of generative AI? Isn't our data now moving in all sorts of new directions? That may be good, but were not the directions that we were thinking about 15 years ago?

Speaker E: So the simple answer is absolutely, you're right, John, that, uh, what we thought about in terms of, uh, fixed data. Think of the, the box of files up in your attic is very different from broadcasting that data through a generative AI. And, and you see the dilemma with generative AI. It's a fantastic innovation, but AI was never intended to forget something. It can forget, by the way, but you have to start all over again. And that's enormous cost, enormous time.

Speaker D: And I think it's also important to differentiate consumer and enterprise. And so it's amazing what consumers are willing to say on the Internet or share on the Internet and accept, but they hold enterprise and government to a much higher standard. And so when you think about generative AI, what's in the public domain, yes, one piece of the puzzle. And what people are willing to share with ChatGPT or expose through their email or whatever, Facebook, other applications is one thing, but from an enterprise perspective, they're much more cautious about what they share because a lot of the data in the enterprise is what differentiates the business. And so you Know, think of a simple example. You're a, uh, technology company and your source code is your intellectual property. Are you going to put that on the Internet? No, of course not. And so those are the types of things that there's a higher degree of protection around. And so I think you always have to think about it in that domain. What's consumer is one vein, and enterprise is a different story.

Speaker C: Tom and Shannon, you've just written a book on some of these challenges. Maybe tell us a bit about it.

Speaker D: Yeah, absolutely. I was privileged enough to work with, uh, Tom and David Fraser as well.

Speaker C: David Fraser being a former military leader in Canada and spent a number of years now with OpenText and others.

Speaker D: Yeah, and an incredible leader, uh, that just brings great insights into the enterprise world as well. We worked on a book on enterprise AI and how you can leverage data to drive that from a sovereign cloud perspective. So very much that enterprise angle. And looking at all of the pieces of the puzzle that need to come together to drive agentic AI for enterprise,

Speaker E: perhaps the way to think of this term enterprise AI, most, uh, of our listeners have played with ChatGPT or they've played with a variety of other chatbots, Claude, et cetera. What they may or may not realize is that all answers that they're getting, let's say, are from the public domain. So famously, ChatGPT was trained on Reddit and trained on Wiki and trained on various things that were part of, uh, the digital commons, if you will. And as Shannon mentioned earlier, that's, uh, you know, Roughly speaking, between 5 and 10% of the world's information, most of it is behind the firewall and therefore enterprise. So an AI built from the enterprise is using different information than you would have had in Reddit?

Speaker D: Yeah, absolutely. I think a great example where you've got information in the public domain and information in the private domain and how the two intersect is think about when you're going to file for a Passport application, you're providing a lot of confidential, sensitive data and you're providing that into the government and they're processing it and they're providing information back to you. And if you think about public domain information, some of your information lives in the public domain and they'll use that to validate certain things about you. And much of your data resides in the private domain. And so when we think about applying agentic, uh, AI to an example like that, we think about what's public information, what's private information. So I might go on the government website and start the process of My passport application validate certain things. But then my information is going to get handed over into that private domain where they're going to run my, maybe a criminal record, check my background check, my address check, all the verifications, required references and so on in order to then correspond with me back in the public domain, where all of that information needs to be stripped of anything that's private or confidential. And so you get into this domain where you have agentic AI working across public and private domains, and that's really where the magic happens. As you start to think of the evolution of enterprise AI, that's a really

Speaker C: great framing for where I hope we can take the conversation now in terms of what this means for Canada. But for Canadian enterprises, uh, be they public sector or private, we all know data is essential to every firm's competitiveness. Also essential to the efficiency and well functioning of, uh, public sector operations as well. But all of that needs to be seen anew in light of this new focus on sovereignty. So how do we think about these data challenges through the prism of tech sovereignty?

Speaker D: I think there's multiple pieces to sovereignty that you need to think about. So data sovereignty is one piece, operational sovereignty is another. As an enterprise is looking at leveraging AI into specific use cases, the most critical piece that's required to enable or build those use cases is subject matter expertise around the business, the business processes, the data itself. And so that is something that the business uniquely has and can build on and build as a differentiator, the ability to train and model those use cases. And so we talk a lot about AI and its ability to potentially displace certain roles. I actually think it's a, uh, phenomenal opportunity in Canada for us to be able to leverage the domain expertise that we have across different industries and use that to train and build agentic AI use cases. We can do that here in Canada, which solves one of the sovereignty pieces. The data is resident here in Canada. So you're building use cases and deploying and operating those inside of and building out an expertise that's not common across the industry today. Uh, and so those unique skills to build on top of business processes and data sets, the agentic frameworks, are things that I think we can uniquely do here in Canada and build as a capability to differentiate across different industries.

Speaker E: There's also, uh, when it comes to sovereignty, John, a darker side to this that we should be all very, very aware of. The simplest way to think of this, it's a bit trite, but what is the difference between shutting off A power plant and bombing a power plant, there really is no difference because you're depriving someone of the use of that plant. This is part and parcel of what we talked about before with globalization. You get the good with the bad because, uh, on the one hand we get all this automation, we get efficiency, we get innovation. But now we've got different governance problems. We have to make sure that citizens are protected, that the utilities that they count on are there and they're properly controlled and governed, and that they're safe. And it's everything around us we know. If there's a power outage, it's very difficult to check out your groceries at the grocery store. It's very difficult to get gas from the gas station. Electricity has permeated our lives and that electricity is run by tech. And so we have to think of sovereignty in a completely new way now.

Speaker C: That's a very good warning, Tom. For years, those cyber threats have largely been malicious. They've been rooted in criminal gangs and maybe in some, uh, malicious state actors. But now we're also into a new age where even friendly states, and the United States might be among them, might use its reach through technology to influence or affect others, uh, including economic partners. There's that expression, the Trump kill switch, which sounds alarming, but it does illustrate a challenge that we need to think ahead to. That a superpower or even a power might be able to flip a switch and shut down parts of our economy or enterprises. How, as Canadians, should we be thinking about this rapidly evolving security paradigm?

Speaker E: You have to take a hard nose approach to capacity versus intent. And uh, you know, in the case of the Americans, we couldn't have had and have a better ally anywhere in the world. But we as Canadians, we should be concerned. When someone has the capacity to control things inside our country, that's a different issue. And, and it's not about the Americans, it's about anyone, any third party actor. We shouldn't allow anyone that is not elected by our citizens to have control over our life, because that's the whole point of a democracy and a sovereign country.

Speaker C: So how do we build that invisible border? Do we need a Canadian cloud? And is that, uh, even possible?

Speaker D: I think there's a combination of approaches and I think we need to understand that the future of technology with respect to sovereign cloud is a hybrid approach. It starts with the foundation of understanding your data, where it is, where it resides, how it's being moved. And that's so critical because AI is transforming economies and because data is the fuel to the AI, it becomes really that piece of the puzzle that you must have control over. Now, that being said, a lot of the data that's going to be critical for enterprise sits in their own domain. In order to build AI models that make sense and can drive that economic advantage, we need to unlock that data that's sitting in the enterprise. And that's really where sovereign cloud becomes so critical. And I think the important piece of it is being able to classify the data and know what is the truly protected data and having a solution to manage that versus the data that you can leverage in the public cloud and leverage the economies and efficiencies of scale in the cloud. And that is why we think it's so critical to really know and understand and build out that hybrid architecture so that you can protect the data that is truly business differentiating and protect the AI that you build from that data and also leverage the benefit and economies of scale of the public cloud. It's hybrid.

Speaker E: And the good news about this is the parts that, uh, have to be protected are actually really small. Think of your own daily life. Most of what we do is in the public domain. It's really when you go get a health checkup or you go to the hospital, or you file your tax forms, these are important private things, but they're actually a very, very small part of the overall picture. And so when we speak about hybrid, we're actually only talking about a small fraction, might be less than 10% of what we do in the day, and the data that we keep and the interactions that we have, it's actually a very small amount, but it's a vital part of our lives. It's a vital part of who we are as people and as a country.

Speaker C: Tom, um, you've been a leader for years in terms of taking Canadian tech to the world. You get to travel the world and talk to tech thinkers and leaders. What are some of the leading countries thinking about now in this new security paradigm in terms of tech sovereignty?

Speaker E: Many of them have come to Canada and asked us for help as a sort of third party, if you will. And this along tradition that Canada has had, many people don't realize whether it's the Canadian mint, even the Canadian Post office. For decades and decades, we provided the infrastructure to many other countries for their currency, for their mail service, simply because we're big enough that we can build our own. And yet a, uh, middle power, we're not very threatening to anyone. We've had dozens of countries approach us and say, can you build us A sovereign cloud that has an independent stack that would not be subject to things like the United States Cloud act and things like that. So many, many countries are on the same journey. They're not as fast as we are in Canada because we have, um, so much of that infrastructure already. They're all asking the question, what does it mean to be sovereign in a digital world? And those are pretty profound questions for societies all over the world. The great benefit Canada has is because we're right beside the United States. We have a huge technology community and an ability to build an entire sovereign cloud stack. We have all the component pieces over many decades of development. Many other countries do not benefit from that. They do not have that deep technological heritage that we do.

Speaker D: And I would say that it's not just a government question. And so there's some interesting Gartner research out that actually talks about the fact that 50% of multinationals will have a sovereign cloud strategy in the next few years. And I think that's really important because when we talk about sovereignty and data protection and AI sovereignty and so on, yes, some of the discussion has started with governments, but it actually is a broader discussion across enterprise. And so we hear it from governments and we hear it equally from many of our largest customers around the world.

Speaker C: Tom, when you mentioned the history and positive legacy of the Mint and uh, Canada Post, I also thought of the role Canada's played in decades past as a store of gold. And many countries literally stored their gold in Canada because it was considered a safe place for that very different age. Today are other countries and companies in those countries looking to use Canada as the place where they store their data or use as a critical base of infrastructure?

Speaker E: Yeah, we've been heavy into those discussions over the last two quarters, like about last six months. And I have to say, John, it's a combination of the two because it's situation specific. If you're a large middle power, such as a, uh, Japan or a Korea, you already have a, ah, pretty substantial technology stack. And so you're really looking to fill gaps. But if you're a smaller country, Ireland or, you know, Romania, small countries in the eu, small countries in Africa, South America, they have very little stack from which to draw upon. So in that case, they're looking for a complete set of capabilities from one country. But it all begins with the domestic telecom, whatever is the domestic telecom. It could be cable and wireless in the uk, it could be NTT in Japan, it could be France, Telekom, Deutsche Telecom. You know, everyone's got a Domestic telecom for the very same reason. They wanted to be able to have sovereign control over their communications on behalf of their citizens. I think you'll find all of those stacks will begin with that. So in our case in Canada, whether it's Bell Canada or Telus or some of the other telecoms, I think you'll see those sovereign clouds begin with the, let's say the part of the stack that a, uh, government regulates and society has control over.

Speaker C: You both mentioned the competitive advantage of skills of talent, as well as a range of companies, including OpenText, including Cohere, which we've had on the podcast in the past. There's also the intangible of trust. How much is trust a factor and an attribute for Canada?

Speaker E: Oh, it's the number one thing. No one should ever think that trust does not matter. It matters to all of us in our daily lives. Why do you use one bank instead of another? It's based on your personal experiences and how you trust that bank. Trust is absolutely paramount on this topic because it really goes to the heart of what you're trying to protect. I know that having done this for 35 years at OpenText, the number one thing that we sell is trust. They, our customers have to trust that we keep up in cybersecurity, that we keep up in a whole variety of different ways. And so trust is paramount. It's more important than anything else.

Speaker D: And when you think of the size and scale of the networks we operate, you know, over 80 data centers around the world, over 75 cloud landing zones, you know, we deal with over 300 billion cyber events a month. I mean we are managing 15 trillion annually in supply chain like trust is at the core of everything we do. And that is something that's synonymous with being a Canadian company.

Speaker C: We've talked through this series that we're calling the Canada Project on all the opportunities for Canada, from defence and space to agri food to critical minerals, what we can provide to the world. I'm so glad that we're also talking about tech capabilities, about data and that, uh, competitive advantage of trust. As we move towards close in our conversation, what does Canada and what should Canadians be thinking about over the next couple of critical years to both maintain our sovereignty and build it, but also be more competitive and relevant in a rapidly changing world?

Speaker E: Well, I've lived this world for pretty much my entire professional career and I can tell you as a firsthand observer, Canadians are great at this. The reality is we have a fantastic heritage of doing this. OpenText is a good example more than 50% of our revenues come from outside of North America. And we're well received all throughout the world. We were talking about trust, but it's also quality. We're competitive, we're very good Canadians. We're really tough on each other. And that's good, that's a good part of a democracy. But make no mistake, when we go abroad, we're the very best in the world. We're very good at, uh, many, many things. I think that the re examination of our role in the world is a good thing for Canada. And I think Canada has a tremendous set of advantages. It's just that, uh, maybe we got a little complacent, maybe we got a little too used to a single market. So I'm actually quite bullish on this. I think Canadians will do very well in the world. They just have to get out there and prove it to themselves.

Speaker D: And I think here at home, technology is an enabler for helping us solve some of the challenges. You know, we talk a lot about workplace productivity and efficiency in the market. And I think that leveraging AI, adopting and embracing, we've been a little slow as a country to do that, but I think that will be an unlock for our own economy as well. And it's an area where we can develop differentiating skills in our workforce, uh, differentiators for our enterprise and for our government that then we can take globally. So I think the two go hand in hand and we are very well positioned as long as we embrace technology to enable that.

Speaker C: So a new age with all sorts of opportunities. It's hard not to be excited. Shannon, for those listening who run enterprises, who run organizations who are thinking about AI, uh, what are a few of the critical things they can and should come to grips with?

Speaker D: I think for enterprises starting the journey, the most important thing is to start. Oftentimes we get overwhelmed by the magnitude of potential and don't know where to start. And really starting the journey is key to actually starting to see some results. And I always advise our teams internally and our customers, start with the simplest use cases, the simplest use cases to start to understand, build literacy in the organization around AI and its potential, remove some of the fear and allow you to embrace change management. And once you start with those simple use cases, you can grow in complexity and start to see better outcomes and understanding the baseline. And don't underestimate the change management as a part of that. It's not just a technology problem, it's a people in process problem.

Speaker C: Shannon, great advice for any team leader Any organizational leader. Tom, what does the country need to think about when we look at the next few years?

Speaker E: We are in a very, very competitive world and we shouldn't make any apology for sticking up for ourselves. I think we should be buying Canadian, but we should be buying Canadian in a very competitive environment. We Canadians should demand the very best in the world and demand that our Canadian suppliers do that and that we create a competitive environment in which we purchase Canadian goods and services and then use those goods and services to export to the world. And to be able to turn around and export it, we have to get out there, we have to change our attitude, we have to take more risk, put more capital to work and export. We used to do this. We used to do this in the 1950s and the 1960s. After World War II, Canada had a very strong place in the world and it executed all throughout the world. We can return to do that and be very welcome in the world, but it does require effort. It does require a strong domestic base from which to do that. We've done it before, we can do it again.

Speaker C: What great messages for everyone. Get going. Embrace, don't be afraid. Help culture change within your organization and get out there in the world. There's nothing but opportunity ahead when you think like that. Shannon and Tom, thank you for all your building with OpenText and for all you're building for Canada. Thank you for being, um, on Disruptors.

Speaker D: Thank you, John.

Speaker E: Thanks for having us.

Speaker A: What's happening in Waterloo and across Canada's Data centre. Buildout isn't just about racks and models. It's about the information layer that keeps daily life running. For decades, secure communications helped define this region to the world. The next chapter is bigger tech sovereignty and proof that people can trust. So personal data stays personal and the switches for critical systems don't sit in another country's jurisdiction. Canada is in the midst of building a very different economy. New tools, new companies, new jobs. We need to safeguard it by setting the foundations here, run the rules in Canada, keep information in Canada and keep a clear, verifiable record of what our systems do across all the services that we rely on. Build it here and we'll hold the advantage that keeps on compounding trust. You've been listening to Disruptors, the Canada Project. Thanks for joining us on this journey across the country. And there's more ahead. A link to Shannon and Tom's new book, Enterprise Artificial Intelligence. Building trusted AI with secure data is in the show notes. If you enjoyed this episode, please follow rate and leave us a review it helps others discover the show. And if you want to gain deeper insights into the ideas shaping Canadian business and the economy, visit rbc.com thoughtleadership Join us next time as we meet more of the innovators and leaders helping Canada meet this moment boldly and on our terms. I'm John Stackhouse. Thanks for listening.