To defend against data centers becoming military targets, governments must prioritize geographic dispersion, treat them as critical infrastructure, and move beyond a cybersecurity-only approach.
For most of the digital age, data centers were treated as background infrastructure, the quiet commercial machinery behind the abstraction called “the cloud.” They hosted financial systems, communications networks, logistics software, and, increasingly, the computing power behind artificial intelligence (AI). Hackers, ransomware, and cyber breaches were the primary threats to these systems. Now, those have become old problems.
The cloud was never some weightless digital mist. It was always a physical system built from land, concrete, transformers, cooling systems, cables, and electricity. This means the cloud is still vulnerable to the old logic of war.
As governments, corporations, and militaries grow more dependent on concentrated cloud infrastructure, the facilities housing that computing power are now strategic infrastructure. Data centers are no longer just anonymous commercial properties tucked behind the digital economy. They are becoming part of the strategic rear: fixed, valuable, energy-hungry infrastructure whose disruption can impose immediate economic and operational costs. With states focused on building digital capacity and AI, including the Pentagon using an AI tool for the Iran War, the data centers built to enable economic productivity and warfighting abilities mean this infrastructure is a newly fixed target that is difficult to harden and protect.
Recent events from the Iran War illustrate the shift. Iranian drone strikes reportedly damaged multiple cloud facilities in the Gulf region, including two Amazon Web Services (AWS) data centers in the United Arab Emirates and a Bahrain facility that suffered damage from a nearby strike. The attacks disrupted services and forced operators to reroute workloads across other cloud regions due to the power disruptions, fire-related water damage, and prolonged outages affecting regional customers, including financial institutions. That should kill off the comforting fiction that the cloud sits safely behind the battlefield.
The damage to data centers is a preview of what future targeting will look like in the next war. Adversaries increasingly understand that digital infrastructure carries coercive value. Disable it, even temporarily, and the effects can spread quickly across finance, communications, logistics, governance, and military command-and-control. What we once believed was invisible digital convenience now looks more like critical infrastructure in the same category as ports, substations, pipelines, and rail hubs. The future of war still requires missiles, drones, and code, but it will also be fought through the physical infrastructure that keeps modern societies online.
Why Data Centers Became Targets
Much public discussion still treats the cloud as diffuse, virtual, and naturally resilient. In reality, it rests on concentrated physical systems. That concentration is precisely what gives data centers strategic relevance. The more economic activity, state administration, and AI capacity are routed through a relatively small number of high-value computing hubs, the more attractive those hubs become as targets in wartime.
Modern hyperscale data centers are enormous facilities designed to house tens of thousands of servers and the networking equipment needed to connect them to global internet backbones. These buildings contain large server halls, cooling plants, power distribution systems, fiber switching equipment, and backup generation. They are often organized into large campuses occupying hundreds of acres. This is some “heavy” infrastructure just for a “cloud” to work.
And it is increasingly concentrated. Northern Virginia, the world’s largest data-center market, has surpassed 3,000 megawatts of inventory, with still more capacity under construction. Large campuses globally operated by companies such as Amazon, Microsoft, and Google consist of multiple hyperscale buildings clustered in a single geographic area. And they are big. The Switch Citadel campus near Las Vegas is designed for more than 7 million square feet of data-center space. The digital economy likes to talk in the language of speed, code, and abstraction. But its physical backbone looks a lot more like industrial geography.
That matters because scale creates vulnerability. The same clustering that improves commercial efficiency also creates a tempting target set. A concentrated cloud architecture may make sense in peacetime because it’s efficient. But in wartime, this is a liability. While countries are racing to build AI capacity, they are also building a new class of strategic assets, whether they realize it or not
Telecommunications and Energy as Strategic Infrastructure in Wartime
The strategic logic behind targeting infrastructure is familiar. Oil refineries, ports, rail hubs, and power plants have long been considered legitimate wartime targets because they sustain economic activity and military capability. Data infrastructure and other dual-use objects increasingly belong in that category. Its commercial significance stretches into financial transactions, communications, logistics platforms, government services, military operations, and growing volumes of AI computing, all of which depend on large commercial cloud systems. Once those systems become central to societal function, the facilities that house them lose their neutrality and look more like critical nodes for attackingkinetically or non-kinetically.
For example, in the early stages of Russia’s 2022 invasion of Ukraine, cyberattacks attempted to disable Ukrainian government and telecommunications systems. But the campaign quickly expanded beyond cyberspace. Microsoft reported that Russian forces struck a Ukrainian government data center with a cruise missile, underscoring a basic wartime reality: when digital systems matter enough, adversaries do not limit themselves to malware and network intrusion. They also go after the buildings and infrastructure that keep them running.
In many cases, however, disabling digital infrastructure does not require destroying the server hall itself. The more efficient path is often to strike the enabling systems around it, especially electricity networks, substations, cooling systems, and fiber links. The cloud relies heavily on power-intensive, highly physical infrastructure whose failure can produce immediate cascading effects that can hurt the economy and military.
Ukraine again provides a useful example. Russia has repeatedly attacked the country’s power grid with missiles and drones. In March 2024, one of the largest such strikes damaged energy facilities across multiple regions, with the attacks leaving more than one million people without electricity and forcing Ukraine to increase imports from neighboring systems. Ukraine and the International Atomic Energy Agency even agreed in 2024 to place international monitors at key substations because attacks on them threatened the stability of power systems supplying nuclear plants. The broader lesson is that digital resilience is inseparable from power resilience. A data center with intact servers but no dependable electricity is still a disabled asset.
Conflicts elsewhere show a similar pattern. In Sudan’s civil war, fighting around telecommunications and electricity infrastructure has repeatedly caused major communications outages. In February 2024, the seizure of telecom facilities in Khartoum led to a nationwide blackout, disrupting aid delivery, payments, and contact with the outside world for millions of people. The broader lesson is that the systems that support digital connectivity can also become a critical center of gravity in the battlespace. Attacking data centers can generate coercive effects well beyond the immediate military front.
Technological change is also lowering the barriers to attacking digital infrastructure. Drones capable of carrying explosive payloads are cheaper, more accessible, and often harder to intercept cost-effectively than traditional missile systems. That matters because they make it easier to threaten fixed, high-value infrastructure that was never designed with persistent aerial attacks in mind. In practical terms, the spread of relatively low-cost strike systems narrows the distance between commercial infrastructure and the battlespace.
A Strategic Adjustment to Data Center Security
Recognizing the strategic relevance of data centers requires more than stronger cybersecurity. If computing infrastructure is becoming contested infrastructure, then the strategy surrounding its design and protection must evolve as well. We suggest three approaches that resolve this growing data center dilemma.
First, geographic dispersion must become a higher priority. Concentrating enormous computing capacity in a small number of hyperscale hubs may be commercially efficient, but it creates systemic wartime risk. More distributed architectures, with workloads able to shift rapidly across regions and jurisdictions, can reduce the consequences of attacks on any single cluster. The Gulf data center strikes exposed the problem: redundancy inside one market is not much comfort if multiple facilities in the same region can be disrupted at once.
Second, major data centers must be treated as critical national infrastructure. Energy systems, ports, and telecommunications networks are already understood as strategic assets whose disruption carries national-security consequences. Large cloud campuses increasingly belong in the same category. That does not mean every server farm becomes a military installation, but it does mean governments need to incorporate major computing hubs into civil-defense planning, continuity planning, and, in some regions, broader air- and missile-defense protective strategies. Countries pouring money into AI capacity have now built assets that adversaries will put at risk.
Finally, resilience standards need to move beyond the old cyber-first mindset. Facilities in exposed regions need stronger backup power, more robust cooling and water contingency systems, greater connectivity redundancy, and more serious continuity planning for scenarios in which surrounding infrastructure is damaged. The point is not that every data center can be hardened like a bunker. The point is that governments and firms alike need to stop pretending the cloud is somehow detached from geography and warfare. The more countries tie their economic competitiveness, public services, and AI ambitions to concentrated computing infrastructure, the more they are building a new class of strategic assets for future adversaries to target.
The cloud was initially abstract and borderless. However, war has a way of finding asymmetric advantages to exploit enemy weaknesses. What remains is concrete, cables, transformers, pipes, land, and power. And anything built from those things can and will be attacked.
About the Authors: Macdonald Amoah, Morgan Bazilian, and Jahara Matisek
Macdonald Amoah is an independent researcher with interests across critical mineral supply chains, advanced manufacturing gaps, the industrial base, and the geopolitical risks in the mining sector.
Morgan D. Bazilian is the director of the Payne Institute and professor at the Colorado School of Mines, with over 20 years of experience in global energy policy and investment. A former World Bank lead energy specialist and senior diplomat at the UN, he has held roles at NREL and in the Irish government, and advisory positions with the World Economic Forum and Oxford. A Fulbright fellow, he has published widely on energy security and international affairs.
Lt. Col. Jahara “Franky” Matisek (PhD) is a US Air Force command pilot, nonresident research fellow at the US Naval War College and the Payne Institute for Public Policy, and a visiting scholar at Northwestern University. He is the most published active-duty officer currently serving, with over 150 articles on industrial base issues, strategy, and warfare.
DOD Disclaimer: The views of Lt. Col. Matisek are his own.
