Every argument I hear against large language models today is one I heard against cloud computing ten or fifteen years ago, delivered with the same cadence, the same certainty, and the same eventual capitulation once the convenience became irresistible. “I don’t trust it.” “It’s watching everything.” “You lose control the moment you sign up.” All true then, all true now, and yet the same people who said these things about AWS in 2011 are the ones who now cannot describe their production environment without reference to at least three services whose configuration lives inside somebody else’s control panel. The skepticism was correct, the retreat from it was near total, and we are running the same play again with a different vendor category on the marquee.

The argument I want to make is not primarily a technical one, though it will pass through the technical details, and it is not primarily an economic one, though it will pass through the economics. It is an argument about what ownership actually means in a computing environment where almost none of the meaningful assets are physical, and where older words for freedom, property, and dependency need to be picked up carefully to see whether they still fit. They mostly still fit, and that’s a pretty unsettling problem to me.

A Definition Before a Position

To be clear, I am not writing this as an opponent of every service I do not host. I use Gmail, Cloudflare, and CIRA DNS. I use them because the value on offer is not merely the absence of a resource cost I cannot satisfy, but a tangible good I cannot replicate at any price I can rationally justify. There is no email server I could run in my rack that the major providers would trust to deliver mail, because Gmail and Outlook do not accept mail from strange, young, or otherwise unfamiliar senders without a great deal of suspicion, and building the reputation to be trusted takes years of consistent uptime, careful DKIM and SPF and DMARC posture, warm IP addresses, and a paranoid attention to any spam signal that could undo the whole effort. If I wanted the uptime the reputation requires, I would be looking at roughly $1,500 a year for a few units of colocation at a Tier 3 facility outside the Cascadia earthquake zone, and I would still be one unpatched vulnerability away from a preventable outage.

That is the distilled principle: sovereignty is worth preserving until the specific value being surrendered cannot be replicated locally at any price I can afford, at which point the honest thing to do is concede the ground, admit what I have lost control over, and move on. That test is stricter than the usual complaint about convenience or the annoyance of running the alternative yourself, and it excludes almost every service the average business now seemingly depends on.

Underneath the test is a definition of ownership, because most of what people mean when they say they own something in a digital context is much thinner than they realize. To meaningfully own a system is to retain the ability to inspect it, modify it, repair it, preserve it, transfer it, refuse changes to it, and, most fundamentally, continue using it without another party’s ongoing permission. Ownership on this account is not a binary. It is a bundle of powers, and any given service arrangement grants or withholds each of them separately. The question worth asking about every subscription and every account is not whether you get value from it today, but whether the powers to inspect, preserve, and continue rest with you or with the vendor. Everything else in this post is downstream of that question.

Applied to LLMs the question does not yield a clean answer, and I will return to it at the end. Applied to most of what has been moved into the cloud over the last decade, it yields a very messy one.

The VPS Was the Fork in the Road

The distinction that matters most, and the one the industry has been careful never to teach clearly, is the difference between a virtual private server and a managed cloud platform. On a VPS you rent a virtual machine. The operating system is yours, the configuration files live where you put them in formats defined by upstream projects with published specifications, and they are portable in the strict sense that you can archive an /etc directory, move it to a different provider’s VPS, and expect most of it to keep working after reasonable adaptation of software installation and network wiring. Your knowledge is transferable, your automation is transferable, your disaster recovery plan is transferable, and if your current provider raises prices or fails you, you can be somewhere else in a weekend.

On a managed cloud platform you do not rent a machine, you rent a relationship with a control panel, and every meaningful piece of your configuration lives inside that panel’s proprietary schema. The IAM policies, the load balancer rules, the object storage lifecycle policies, the serverless function bindings, the VPC peering arrangements, none of these have a portable representation because none of them were designed to have one. There is no export button that gets you out, not really. You can pay for a Terraform overlay that pretends to abstract the difference, and the moment you try to lift-and-shift you discover that half the primitives do not map, and the other half map only with a great deal of hand-modification. What was sold as flexibility turned out to be entrenchment, priced in per-hour billing.

The reason this matters philosophically, and not only operationally, is that customers pour genuine labour into these environments. They spend years learning the vendor’s model, writing the automations, training the staff, refining the policies. Any Lockean theory of property, and most of the intuitions we still rely on when we call something ours, begin with the premise that the person who worked to produce a thing has a moral claim on the value they created. Accumulated cloud configuration is exactly such a thing. It is a real asset, produced by real work, and it ought to be portable in the same sense that any other product of labour is portable. What the managed cloud does, more efficiently than any prior industry has managed, is arrange for the value of that labour to become inseparable from the vendor’s property. A decade of institutional knowledge gets poured into a vessel that cannot be emptied. Departure, when it comes, means abandoning the work rather than moving it. The best a departing customer can hope for is a somewhat current conversion table, or a guide written by a bitter blogger who has done the migration once, or, if you are a large enough account, the courtesy of your prospective new vendor charging you tens of thousands of dollars to consult on an import project that will still leave portions of your estate stranded. I have seen this happen enough times to recognize it as the shape of the market rather than an “accident” of it.

The Underlying Network Was Never Yours

There was a time, and it was not long ago, when it was well understood that having root on a virtual machine did not mean nobody else had root on the hypervisor beneath it. Anyone with the physical infrastructure to host thousands of clients running hundreds of thousands of virtual machines and containers also had the leftover compute and network position to inspect any of it, to correlate flows, to observe encrypted traffic patterns, and to receive a legal order and produce whatever the order asked for without the customer being told. This was never paranoia, it was the operational reality that anybody with a background in networking or security understood as a matter of fact.

The record of the last twenty years has confirmed all of it. Mark Klein’s disclosures about Room 641A in San Francisco showed AT&T splitting fibre traffic to the NSA well before most of the industry had heard the word cloud. The 2013 Snowden disclosures made public what was widely suspected about upstream collection at the fibre level, the PRISM program and its cooperative arrangements with the largest platforms, and the specific involvement of the hyperscalers in programs their public relations departments had spent years denying. The 2018 CLOUD Act formalized the ability of American law enforcement to compel American providers to hand over data stored anywhere in the world, a jurisdictional claim that made every non-American customer of AWS, Azure, or Google Cloud a legally simpler target than they had been the week before. The routine issuance of national security letters, the gag orders that accompany them, and the transparency reports that show the numbers going up year over year, are a matter of public documentation. Add to this the steady drip of breaches at cloud providers themselves, the Capital One incident, the Microsoft signing key theft that let a state actor mint Outlook tokens at will, the SolarWinds cascade, and the pattern stops looking like a few bad quarters and starts looking like a working assumption on which any responsible architecture ought to be built.

None of this means the cloud is useless, only that the sovereignty question was answered, publicly and repeatedly, and the market responded by moving in the opposite direction anyway. People do not remember that these arguments were live, because the outcome was decided, and there seems to be a strong incentive among senior leadership across many organizations to forget that a decision was ever made. The LLM debate is louder now because the decision has not been made yet. It will be soon, and unfortunately there appears to be no reason yet to believe the result will be different.

Interface as Bait, and What a Good Interface Used to Look Like

The mechanism by which people are drawn into non-portable environments is almost always a beautiful interface, and it would be foolish to blame the users for that. Polished interfaces are what most people want, most of the time, and there is nothing wrong with wanting them. The problem is what sits behind the interface, and whether the interface is a window onto standards you could have used anyway, or a proprietary layer that only makes sense inside a subscription.

The clearest historical example of an interface that got this right was Mac OS X Server in the mid-2000s. What Apple shipped was a polished graphical front end onto entirely conventional, entirely standards-based server software. The DNS was BIND. The mail was Postfix with Cyrus and later Dovecot. The calendaring was CalDAV. The directory was OpenLDAP. The VPN was racoon speaking IPsec. The firewall was ipfw and then pf, the file sharing was AFP and SMB, and all of it sat on top of open protocols and open implementations. The UI simply made them approachable to administrators who did not want to hand-edit zone files at two in the morning. The value of the interface was real, it did not require Apple client devices to consume, and it could be dropped in front of a heterogeneous environment or ripped out entirely in favour of the underlying open source stacks whose configuration files it had been quietly editing all along. Sovereignty was preserved because the interface was a convenience layered over portable primitives rather than a replacement for them.

That product had almost no lock-in surface, which is, I suspect, precisely why Apple killed it. By 2011 the server features had begun their retreat into a desktop application, by the middle of the decade the desktop application had been hollowed out, and by 2022 there was nothing left. In the same span Apple pivoted the entire consumer experience toward iCloud, toward accounts managed at Apple’s discretion, toward storage quotas set by Apple’s pricing team, and toward a device relationship in which the customer owns the hardware in the narrowest legal sense and Apple owns the software environment in every operational one. The line from Mac OS X Server to iCloud is a story about a company noticing that a good product was leaving money on the table by refusing to trap its customers.

Today’s cloud user interfaces work the other way around. The polish is quite good, and it exists in service of an underlying environment you cannot leave, cannot replicate, and do not own. The chat window is the new panel, the memory features and the deep research modes are the new proprietary schema, the project structure is the new IAM policy, and the export button is once again nowhere to be found. What appeared to be your working environment turns out, on inspection, to have been a room in someone else’s house.

The Last Mile Was Built for Consumers, Not Hosts

Something I noticed almost immediately after finishing my networking coursework, and which the years since have only intensified, is that internet service providers are not architected the way a well-designed campus network is architected, or the way a modern data centre is architected. They are architected around the assumption that the customer is a viewer rather than a host. The last mile is asymmetric because the business model is asymmetric, and the routing decisions further up the stack follow the same logic. What matters to the ISP is throughput between the backbone and the end user, on the presumption that the end user is fetching content produced somewhere else. Interconnectivity between customers, and particularly interconnectivity between buildings owned by the same customer, is not a design priority, it is an afterthought that occasionally becomes a paid service after enough begging and pleading from the customer.

The consequences of this are worse than most people realize. I have watched building-to-building connectivity within the same municipality, on the same ISP, perform at a small fraction of the link’s rated capacity, because the ISP has no interest in routing that traffic efficiently between two accounts that happen to belong to the same organization. Shaw customers with multiple sites in Victoria are frequently better off finding a third-party regional carrier such as Access Data Group, or negotiating line-of-sight wireless with a friendly local business willing to host a radio on their building, than they are with trusting Shaw or Telus to route sensibly between two of their own connections. Enterprise 10 gigabit symmetrical links routinely deliver half to a tenth of their rated throughput between sites unless you pay for MPLS and negotiate directly with the ISP’s engineering team, which in the case of Telus, the primary fibre provider on Vancouver Island, is an exercise in patience that would test a saint.

A former employer of mine had to do exactly this to get low-latency, high-throughput connectivity between their primary data centre and their disaster recovery site in Kelowna. There is no consumer path to that arrangement, no small-business path to it either, you pay for MPLS, you get in front of Telus’s engineers, and you accept that the ordinary product will not do what the marketing materials imply. That is not the failure of one ISP so much as the shape of an industry that spent twenty years optimizing for a world in which nobody would ever want to serve anything from home or from their own office.

Consider, briefly, a saner counterfactual. In a world where the sovereign server had remained a normal thing for individuals and small businesses to operate, iPhones might never have run out of storage, because there would have been a natural home for the photos. ISPs would have faced sustained demand for symmetric bandwidth and functional peering, and the last mile would look nothing like it looks now. The economic pressure that would have produced a better internet came from a customer base that no longer exists in sufficient numbers, because the industry successfully convinced them they did not need it.

What Sovereignty-Preserving AI Actually Looks Like Right Now

Which brings us back to the question I opened with. A sovereignty-preserving posture toward AI in 2026 exists, and it consists of FOSS web application front ends, Ollama or vLLM or llama.cpp on the back end, and open weight models from the various labs that have decided to release them. I run some of this myself, and I recommend it to anyone who can support it.

The trouble is that anyone can support it only in a narrow sense of anyone. The hardware costs are genuinely obstructive. Consumer GPU pricing has been distorted for the better part of a decade by successive booms in cryptocurrency and then in AI training, and the market for used enterprise cards is thin. A machine capable of running a competitive open weight model at usable speed, with enough VRAM to hold a serious context window and enough system memory to serve concurrent sessions, is a several thousand dollar build at the low end and comfortably five figures at the high end. This puts it in reach of recently retired gamers with a spare 4090, and of professionals earning north of 200K a year, and effectively nobody else.

There is a stronger case for local AI than the price argument, though. Language models are increasingly the environment in which people do their preliminary thinking. They are used before an idea is defensible, before a diagnosis is confirmed, before a legal position is settled, before a business plan is coherent enough to defend to a board. The privacy required for thinking is much greater than the privacy required for publishing, and a hosted service, however well-intentioned, cannot provide it. People behave differently when they know that their inputs are being logged, classified, and potentially subject to moderation, and one of the ways they behave differently is to avoid asking the questions that would most benefit from an answer. A local model, running under weights you possess and configurations you control, creates a domain of cognitive privacy that no subscription can offer.

The point extends further than privacy. Owning your model, or at least owning its weights and being able to read the configuration around them, means that the answers you receive have not been quietly shaped to lead you towards conclusions the vendor, its partners, or a government has decided you ought to reach. A hosted model is a black box in that specific sense. You do not see the system prompt. You do not see the fine-tuning corpus. You do not see the reinforcement-learning preferences that determined which of two coherent answers the model chose to give you. You do not see the refusal patterns, the topics that have been discouraged, the framings that have been amplified, or the sources that have been promoted or demoted. Every model update is a fresh act of trust, because the shaping can change silently between versions and there is no diff you can read. The historical precedent for that kind of trust is not encouraging: search rankings have been reweighted for commercial reasons for two decades, social feeds have been experimentally modified to test whether user emotional states could be manipulated at scale, and content moderation policies at every major English-speaking platform have been rewritten under political pressure within the last five years. There is no reason to believe that hosted models, which sit a full layer deeper in the cognitive assistance stack than a feed algorithm does, will be governed with any greater restraint. The same class of legal instrument that already compels providers to hand over customer data can just as easily compel them to reshape what their models will and will not say, and neither the customer nor the public has any right to be told that either has happened. A local model is not free of bias, because its weights carry the biases of their training corpus; the difference is that those biases can be measured, named, and worked around, rather than shifted underneath you whenever the vendor, or someone standing behind the vendor, decides you ought to be nudged somewhere new.

The other case worth stating plainly is about what FOSS actually protects. The point of an open source ecosystem was never primarily to avoid licence fees, whatever the surface framing might suggest; the point was to preserve a community-wide right of continuation, so that no single party could revoke the ability of everyone else to keep using the software they had built their work around. Open weight models extend that logic into an area where its extension is not yet guaranteed. Some open weight licences are genuinely permissive. Others are more restrictive than they appear, and organizations that intend to build on them should read the licences with the attention they deserve, because the difference between openness that survives a vendor’s next quarterly board meeting and openness that does not is not always visible from the marketing page.

The saving grace is that colocation remains affordable for organizations even when a home lab is not. A local business can absolutely justify three to ten thousand dollars a year for a few rack units in a regional facility, and that budget puts a real sovereign AI capability on the table in a way that a bedroom rack does not. The path forward for small and mid-sized organizations that want the value of AI without the lock-in is almost certainly colocated, almost certainly open-weight, and almost certainly built on FOSS front ends that are actually portable between hosting environments. The math has to work on both capex and opex, the staffing has to be honest about who will actually run and tune the thing, and the alternative, paying twenty dollars a month per seat until the vendor decides the number is now sixty, has to be recognized for what it is, which is a slow negotiation of the organization’s independence away in units small enough not to trigger the finance committee.

The Freedom That Actually Matters

There is an older word for the freedom I have been describing, and it is not autonomy or independence but non-domination. Republican political theorists, going back through Machiavelli to the Roman jurists, distinguished freedom from the mere absence of interference and defined it instead as the absence of another party’s arbitrary power over you. A benevolent master may rarely interfere with a servant, but the servant remains unfree, because the master retains the capacity to interfere whenever they choose. That distinction, made for a very different set of institutions, describes the relationship between the modern organization and its cloud vendor with a precision that ought to be uncomfortable.

The vendor may be gracious. The vendor may be reliable. The vendor may charge fairly, honour its commitments, and treat your data with genuine care for years on end. None of that changes the underlying position, which is that the vendor retains the power to raise prices, alter features, discontinue products, reshape the interface, restrict the model, and shift the terms of the relationship at any time, on conditions you did not negotiate and cannot decline without also declining the work that has become entangled with the service. The freedom the market has been selling for the last fifteen years is the freedom to be interfered with less often, which is not freedom in the older and more useful sense, but a courteous form of dependence.

The market is pushing a bittersweet solution, a beautiful interface over a proprietary environment you cannot leave, priced at twenty dollars a month until you are entrenched and then priced at whatever the vendor decides you will pay. It worked with cloud, it is working with AI, and it will keep working until enough people remember that they have seen this movie before and did not like how it ended the first time. Even when hardware prices return to sane levels, the question will remain whether enough leaders recognize the value of sovereignty, or whether they will continue to become a product of their own subscriptions. The sadder truth, in an unambitious country like Canada, is that most leaders will take the subscription without noticing they have accepted anything at all. The competitive and principled ones, the organizations that place any real weight on the ethical propositions that make ownership matter in the first place, will take the harder and more rewarding path, and preserve for themselves and for the people they serve the only freedom in this domain that has ever really been worth defending, which is continuity without permission.