Recent attacks on data centres in conflict zones have underscored the growing vulnerability of critical digital infrastructure to drone and missile strikes, highlighting the need for enhanced protection measures. In Ukraine, strikes on Russian-operated data centres in Kyiv have disrupted key aspects of the digital economy, including mobile payment systems and ridesharing services. Conversely, Russia has also targeted Ukraine’s data centre infrastructure, while Iran has launched attacks on facilities in Bahrain and the United Arab Emirates, including major centres run by prominent U.S. cloud service providers.

The strategic targeting of data centres marks an evolution in modern warfare, where the distinction between military and civilian infrastructure has increasingly blurred. Historically, combatants have attacked communications and command nodes to disrupt enemy command-and-control capabilities; the United States struck communications hubs during conflicts in Iraq and the Balkans, and Russia targeted at least one Ukrainian government data centre early in its 2022 invasion. However, 2023 has seen a marked acceleration in attacks focused specifically on data centres, reflecting their growing importance in national security calculations.

Several factors contribute to this trend. Data centres are expanding in size and complexity, making them lucrative targets that can inflict outsized economic damage relative to the cost of attack. For instance, Iranian strikes on U.S.-operated Amazon data centres in the Gulf region targeted relatively small facilities, but the ongoing development of large-scale campuses designed for artificial intelligence workloads involves much greater investment and risk. The International Committee of the Red Cross has urged governments to separate military and civilian technology infrastructure to protect vital civilian services, but many are moving in the opposite direction.

The growing geopolitical significance of data centres is particularly evident in the Gulf region. Iran’s public threats and attacks against tech infrastructure have disrupted ambitious efforts by the United Arab Emirates and Saudi Arabia to establish themselves as AI industry leaders. The UAE, which successfully petitioned the U.S. government to permit the unrestricted purchase of advanced AI chips, has partnered with OpenAI and its own AI firm, G42, to develop multi-gigawatt data centre campuses. Following Iranian drone attacks, the UAE is reconsidering its approach, shifting from a single large campus to a distributed network of smaller centres incorporating enhanced physical defenses such as blast-resistant materials, electronic jamming equipment, missile defense systems, and underground facilities.

Globally, data centre operators are reassessing security protocols amid the proliferation of cost-effective drone and missile technologies. Traditional physical security measures like guards and fencing are increasingly viewed as insufficient. Some countries, including Russia, now require their data centres to adopt active defense measures against drone intrusions. These developments may pose significant challenges for nations pursuing “sovereign AI” strategies that rely on localized infrastructure to maintain data sovereignty and security. For example, Russia’s state efforts to nationalize cloud infrastructure and technology firms have not shielded data centres from attack, as demonstrated by Ukrainian drone strikes. Similarly, localization rules have not prevented data loss in the Gulf, where AWS confirmed that Iranian strikes permanently destroyed data stored at a Bahraini facility.

As the threat landscape evolves, the concept of data protection is extending beyond cyber defenses to encompass physical security against kinetic attacks, signaling a new era of risk for the global digital backbone.