Who holds the switch

On August 22, hours after trade talks with the United States collapsed, a new round of 50% tariffs took effect on roughly $20B of Canadian goods.¹ Within a week Canada had doubled its counter-tariffs on steel and aluminum, a dollar-for-dollar retaliation package was scheduled for September 8, and Washington was threatening higher automotive tariffs for the year ahead.² The Prime Minister’s account of the collapse was short: “We were not prepared to compromise Canada’s sovereignty or undermine our key industries.”³

August 22 was another click of a ratchet that has been tightening since February 2025, and the record shows the mechanism. Tariffs imposed under one statute were struck down by the Supreme Court and reimposed under others within days.⁴ Negotiations have collapsed twice. At its July review the continental trade agreement was left unrenewed, on a year-to-year clock.⁵ Eighteen months in, the planning assumption writes itself: this pressure is the operating environment now, and each round makes the next easier to start. The instruments on both sides have converged, too. Ontario’s premier answered the newest tariffs by threatening to cut electricity and critical-mineral exports to the United States.⁶ Both sides now reach first for the switches.

Every round so far has priced goods: steel, aluminum, dairy, cars. The same conditionality reaches the technology layer with none of the visibility. A tariff on steel arrives in a proclamation; the terms of access to an update feed, a vendor portal, or a sustainment channel can change without one. For the institutions now being told to build Canadian, the security question underneath the industrial one is concrete. The chain that moves software into a Protected B or Secret environment is a set of standing connections, and each stays open only while a counterparty chooses to keep it open. Series one of these field notes argued that sovereignty of the supply chain is a procurement question. This second series is about practice, and it begins with the audit this moment invites: walk the chain, and at every link, ask who holds the switch.

The switches already thrown

Tariffs are the visible instrument. The record of the same eighteen months holds three quieter demonstrations of what a standing channel is worth when the counterparty reconsiders.

In March 2025 the United States paused military aid and intelligence sharing to Ukraine to move Kyiv toward a negotiating position. The pause was confirmed publicly by the CIA director and lasted roughly a week, until Ukraine accepted a ceasefire framework.⁷ Ukrainian officials later described the intelligence feed, not the weapons, as the binding constraint. A capability delivered as a service had been withdrawn mid-war, deliberately, as leverage, and then restored. The channel worked as designed, and closure was part of the design.

In July 2025 a second pause halted deliveries of air-defence interceptors and artillery ammunition already committed to Ukraine. This one originated inside the Pentagon, out of a stockpile review, and reporting at the time indicated the White House had not been informed; the President reversed it within a week.⁸ The instructive part is where the switch was thrown from. The channel closed without a head of state, a policy, or an announcement; one office with its hand on the flow was enough.

In May 2025, three months after the United States sanctioned the International Criminal Court’s chief prosecutor, it was reported that his Microsoft email account had been cut off. Microsoft disputed that it had terminated services; the account moved to a Swiss provider, and the court began migrating to open-source tooling it could operate itself.⁹ Whatever the mechanics, the shape of the episode was legible to every institution watching: a sanctions designation reaches an individual through the software he works in, because every provider with a US nexus is conscripted the moment the designation lands. The court’s answer was to change who holds the switch.

None of the three episodes required a new statute or a declared policy. Each used infrastructure that existed for cooperation, and each ended quickly: the aid resumed, the deliveries restarted, the account question faded from the news. That is the part worth keeping. A switch does not have to stay thrown to do its work. One demonstration repriced every channel that resembles it, and Canada’s institutions have spent the eighteen months since counting how many of their own channels qualify.

Walking the chain

Start the audit where a deployment starts. Software that ends up in a Protected B or Secret enclave is built somewhere else: assembled from components fetched out of registries, scanned against vulnerability feeds, signed by services, licensed against entitlement servers, and delivered through a portal, a courier, or a person with a briefcase and a clearance. Every step in that sentence is a standing connection. The registry answers today because a company chooses to keep it public; the vulnerability feed updates because an agency keeps publishing. And the entitlement server grants access for exactly as long as an account stays in good standing under someone else’s law. Walk any real chain and the count comes out the same way: most of the links are switches, and almost none of them are held inside the enclave they feed.

The clearest public illustration is the one Canada spent 2025 debating. When allied F-35 customers asked whether the aircraft carried a kill switch, the program office answered truthfully that none exists.¹⁰ The answer satisfied nobody who understood the sustainment model. Mission data, software updates, and spares flow continuously from the manufacturer’s side of the relationship, and a fleet cut off from that flow degrades in weeks and becomes a museum piece over months.¹¹ The dependency has the shape of a subscription rather than a button, and subscriptions have counterparties.

Buyers have noticed, and the noticing is now written down. Saab’s standing offer in Canada’s fighter deliberations itemizes what it would place under Canadian control: assembly in Canada, source-code access for mission systems, sovereign data control, independent rights to upgrade and maintain.¹² The submarine procurement Canada advanced this summer pairs the boats with domestic sustainment arrangements from the outset.¹³ Read those documents as answers to one question. Procurement has begun pricing the switch, line by line, in the layer where Canada buys airframes and hulls.

The software layer deserves the same line items and mostly does not get them, because its switches are quiet. An airframe’s sustainment terms are negotiated in public and reported when they change. A feed’s terms are a clause in a services agreement; a portal’s availability is a status page; an entitlement check fails silently somewhere in a build log. And unlike hulls, most of the links cannot be nationalized. Canada is not going to rebuild the world’s software commons inside its borders, and no serious buyer should want it to. The audit’s value is in the sorting it forces: some links can move inside the enclave, some can be made replaceable, and a small set, the ones the trust of the whole chain rests on, must stop being switches at all.

Trust is not a procurable

The sorting has a principle, and it turns on what a thrown switch can do. Most switches in a delivery chain are availability switches: the feed stops, the portal closes, the parts stop arriving. Institutions know how to manage that class of risk, because navies and air forces have always managed it: stockpiles, mirrors, second sources, degraded modes that trade freshness for endurance. An integrity switch is different in kind. A counterparty that can alter what enters the enclave, or that must simply be believed about what it delivered, holds a switch whose throwing is invisible. There is no stockpile against a lie.

Trust is the word for accepting that position, and trust is not a procurable. No clause buys a counterparty’s future goodwill; August 22 was a demonstration that clauses are the first thing erased. What a contract can buy is properties, and for the trust-critical links there are three. Provenance that travels with the artifact: a record of what it is and what it was built from, bound to the thing itself rather than to an account on somebody’s server. Verification that completes inside the enclave, offline, without the producer’s participation, so the check works the same on the day the relationship does not. And evidence that stays with the operator: a durable record of what was delivered, what was verified, and what was applied, held on the operator’s own infrastructure and readable years later without anyone’s cooperation.

Properties like these do not remove the counterparty, and they are not autarky by another route. The registry, the feed, and the vendor all remain. What changes is what their switches can reach. With provenance, offline verification, and operator-held evidence in place, a counterparty that withdraws costs the enclave freshness: updates arrive late or by another road, and planners manage the gap the way they manage any supply problem. What the withdrawal cannot cost is certainty. The operator still knows what is running and that it has not changed since it was verified, and can show an accreditor the record without asking permission. The evaluation question fits in one line, in the style a procurement document can carry: can the operator verify what this chain delivers, alone, offline, on the day the relationship ends?

The ratchet has not finished clicking. Canada’s counter-tariffs arrive September 8, and the institutions being told to build Canadian are being asked to do it in this weather. The notes that follow in this series stay at the working level of that task: what the new supplier certifications ask of a software vendor, what ITSG-33 expects of a deployment pipeline, how software actually crosses into disconnected environments, what sustainment terms are worth once you read them as switch clauses. Through all of it runs the same audit, link by link. What makes a technology base sovereign is decided at that level: whether the people who depend on it can verify what it delivers, and whether the evidence stays in their hands on the day a counterparty changes its mind.

Northfleet is a Canadian-incorporated vendor building the sovereign supply chain that wraps a customer-operated classified cluster: a deploy-time bundle protocol, attestation chain, and tamper-evident audit trail. The customer’s cleared engineering teams operate the cluster on Canadian-jurisdictional infrastructure, under their own keys. Northfleet holds no customer data and no customer signing keys. Every release Northfleet ships carries provenance binding it to the source it was built from, which the customer can check without Northfleet’s participation. The architecture assumes the vendor can be compromised or compelled. That assumption is what stops a compelled vendor from silently changing what runs in the cluster.

If you own a chain that ends in a Protected B or Secret enclave and you have started counting its switches, the conversation is open.