Data Centers Become New Frontiers of Modern Conflict
This year has demonstrated that data centers are becoming prime targets in modern warfare, with prominent examples emerging from the Russia-Ukraine conflict since late September.
Both sides have repeatedly struck each other’s data centers, severely disrupting civilian internet connectivity and critical digital services essential to daily life. The phenomenon is not limited to Ukraine; data centers have also been targeted in the ongoing war in the Middle East.
In October, Ukrainian drones struck three data centers operated by the Russian technology giant Yandex, disrupting services and damaging artificial intelligence infrastructure. Earlier this year, Iranian drones damaged Amazon Web Services facilities in the United Arab Emirates and Bahrain, causing web outages across the region.
The Legal Duty to Protect Civilian Infrastructure
This new frontier of warfare raises a question that has received far less attention than whether States may lawfully attack such facilities: what must States do to protect civilians and civilian objects under their control from the effects of enemy attacks on data centers?
The answer lies in the law of armed conflict rules on passive precautions. Those rules dictate whether and under what conditions a State must ensure that its own military facilities are not co-located with civilian objects and civilian population centers.
Data centers house networked servers and related equipment for storing and processing data, often with remote access. Because servers consume vast amounts of electricity, they generate a great deal of heat. As a result, a data center’s operation relies on power, cooling, and connectivity.
Each presents a vulnerability during an armed conflict that an attacker can exploit to neutralize the center’s operations and the services that rely on it. This is significant because many actors do not build their own centers but instead rent servers or computing capacity from commercial data center providers.
Nations Seek Sovereign Solutions Amidst Rising Threats
France unveiled Arcadia, a command-and-control platform housed in a vast underground data center at Mont-Valérien fortress for exclusive military use. The French initiative has obvious strategic logic as it reduces European militaries’ dependence on U.S. cloud providers such as Microsoft Azure or Amazon Web Services.
Concerns over that reliance, and over so-called data sovereignty more generally, have spread across Europe. As another example, the Dutch Ministry of Defense is also investing in a sovereign, military-controlled cloud for classified information hosted in a dedicated data center.
Data centers are often massive, cavernous buildings in remote areas containing expensive equipment that cannot be picked up and moved quickly. Most data center security standards focus on physical access restrictions and fire suppression, not withstanding attacks from the air like drones or missiles.
Vulnerabilities Define the New Battlefield
Doug Madory of Infoblox stated that 2026 is expected to be the first year where drone strikes taking out data centers become a recognized risk. He noted that nobody had anticipated this as a risk to interrupt service before this point.
When Alexander Olshansky received a call in September telling him that the data center hosting his company’s infrastructure in Kyiv had been destroyed by a Russian attack, he made a beeline for the scene. Despite the facility’s destruction on September 23, just around one in 20 of MiroHost’s customers were affected because the company had reserved enough computing capacity in Poland, the Czech Republic and Slovakia to back up its Ukrainian infrastructure.
Other data centers haven’t fared as well, with attacks disrupting services and damaging critical AI infrastructure. Because of their vital role in the economy, data centers are designed with multiple layers of security. However, those defenses are mostly focused on stopping bad actors from getting inside or keeping services running when equipment fails—not on withstanding attacks from the air.
The Importance of Preparedness and Future Outlook
The encouraging part is that nations are now actively addressing these vulnerabilities through sovereign initiatives and better strategic planning. While the threat landscape has evolved significantly, early findings suggest that a shift toward dedicated military-controlled clouds and robust backup systems can mitigate risks.
Patients in our digital society should be aware that while infrastructure attacks are severe, redundancy and sovereignty measures are being implemented to ensure continuity of essential services. The focus is shifting from purely physical security to encompassing air defense readiness.
If you have concerns about your own digital footprint or reliance on specific cloud providers, talk to your doctor or IT security specialist for personalized advice. As we move forward, the goal remains to balance operational efficiency with the necessary precautions against emerging threats.
Strategic Logic Behind Sovereign Military Clouds
The drive toward sovereign solutions stems directly from the realization that reliance on commercial cloud providers creates significant strategic vulnerabilities during conflict. France has addressed this by building “Arcadia,” a command-and-control platform housed in a vast underground data center at Mont-Valérien fortress. This initiative is explicitly designed to provide operational efficiency for the French armed forces while reducing dependence on U.S. cloud providers such as Microsoft Azure or Amazon Web Services.
The Dutch Ministry of Defense follows a similar path by investing in a sovereign, military-controlled cloud specifically for classified information hosted in a dedicated data center. These efforts reflect broader concerns over data sovereignty that have spread across Europe, where nations recognize that massive, cavernous buildings containing expensive equipment cannot be picked up and moved quickly during an attack.
Because many actors do not build their own centers but instead rent servers or computing capacity from commercial providers, a single facility may simultaneously host infrastructure for multiple entities. This interdependence means that attacks on one location can disrupt services across the region, as seen when Iranian drones damaged Amazon Web Services facilities in the United Arab Emirates and Bahrain, causing web outages. Consequently, nations are shifting focus toward dedicated military-controlled clouds to ensure continuity of essential services.
Nations are now actively addressing these vulnerabilities through better strategic planning and robust backup systems. While the threat landscape has evolved significantly, early findings suggest that redundancy measures can mitigate risks. The goal remains to balance operational efficiency with necessary precautions against emerging threats like drone strikes taking out data centers, which experts predict will become a recognized risk starting in 2026.
Sources
- Naval Undersea Warfare Center
- Data Centers at War: The Defender’s Duty to Protect Civilians
- Our digital lives increasingly depend on data centers. How do we secure them?
Photo: U.S. Army Reserve photo by Capt. Katherine Bustos (Public domain)
