PHOENIX (AZFamily) — The war in Iran has revealed a new type of high-value military target: data centers.
Last month, Iranian drones struck three data centers — two Amazon data centers in the United Arab Emirates and a third in Bahrain. Iran’s Revolutionary Guard Corps later released a list of 29 tech targets run by companies like Google, Microsoft and Palantir, and followed up with a video threatening to bomb OpenAI’s $30 billion Stargate data center.
Emily Harding, director of the Intelligence, National Security and Technology program at the Center for Strategic and International Studies, said attacks on data centers mark a “sea change in warfare” that will require new U.S. policies. Before joining CSIS, Harding served in senior roles at the CIA and the National Security Council.
Why data centers became targets
“Data is the new way of war,” Harding said on the latest episode of Generation AI. “You cannot fight modern war without knowing exactly where you are on the battlefield and where the adversary is on the battlefield.”
She said the advent of AI-powered systems like Maven Smart System requires significant data and compute power, making data centers essential to warfighting efforts. And data centers are relatively soft targets; they’re usually considered civilian infrastructure and are not well defended.
“They’re big warehouses, basically,” she said. “And they don’t necessarily have a lot of defenses around them.”
Lessons from Ukraine
The importance of data centers emerged in the conflict between Russia and Ukraine. Harding said Ukrainians realized early that data centers would be targets of the Russian government, so Ukraine passed a law allowing the country to move data outside to facilities in other countries.
Russia was reluctant to attack those data centers, some of which were in NATO countries, Harding said. Instead, Russia went after them with cyber attacks and attacked data inside Ukraine.
“The Iranians, however, have had no such compunction,” she said. “They’ve decided that targets inside the UAE and in Bahrain were legitimate targets if they were data centers that were perhaps aiding the American war effort.”
Are data centers lawful targets?
A strike on a data center at Bank Sepah in Tehran raised questions about whether data centers are lawful targets under international law. Harding said it’s a very difficult legal question.
The bank was responsible for payments to the IRGC. “That’s a military target, if you look at it that way,” Harding said. “It also is a bank that serves civilians.”
She said international lawyers will debate whether such targets are dual-use, military or civilian.
“What it really does is put data center companies in a position where they’re going to have to think about themselves differently,” she said.
Threats to domestic data centers
Arizona is one of the biggest hubs in the country for data center development. There are 98 data centers currently operating in Arizona and another 86 centers planned or under construction, according to Pew Research.
Harding said there are two ways data centers could be attacked: kinetic attacks and cyber attacks.
It would be a significant escalation for a hostile actor like Russia or Iran to go after a data center inside the United States with a kinetic attack, she said. But cyber attacks are considered far less escalatory.
“There’s probably a much lower bar to do something like that,” Harding said. “And that’s where the U.S. government is going to have to make some decisions about exactly how they view this infrastructure.”
Protecting data centers
Harding outlined three steps the U.S. government can take to protect data centers.
First, share more intelligence with data center operators. The government currently has a duty to warn companies if it learns they’ve been targeted, but it’s a high threshold – the information needs to be “actionable and specific.” Harding said the intelligence community should “open up those taps and share more information.”
Second, act as an insurer of last resort. If insurance companies have clauses voiding coverage in case of war, the U.S. government could serve as a backup insurance provider. That would give tech companies more assurance that their financial assets are covered.
Third, establish deterrence by messaging to adversaries that any attack on a data center will be considered an attack on the United States.
“The three of these things together, I think, would be a pretty good safety net for these companies,” Harding said.
She also suggested Gulf countries could pass laws loosening restrictions on private actors deploying anti-drone capabilities. That could shift some of the burden of protection off governments and allow companies to more forcefully protect their data centers.
See a spelling or grammatical error in our story? Please click here to report it.
Do you have a photo or video of a breaking news story? Send it to us here with a brief description.
Copyright 2026 KTVK/KPHO. All rights reserved.