PHOENIX (AZFamily) \u2014 The war in Iran has revealed a new type of high-value military target: data centers.<\/p>\n
Last month, Iranian drones struck three data centers \u2014 two Amazon data centers in the United Arab Emirates and a third in Bahrain. Iran\u2019s Revolutionary Guard Corps later released a list of 29 tech targets run by companies like Google, Microsoft and Palantir, and followed up with a video threatening to bomb OpenAI\u2019s $30 billion Stargate data center.<\/p>\n
Emily Harding<\/a>, director of the Intelligence, National Security and Technology program at the Center for Strategic and International Studies, said attacks on data centers mark a \u201csea change in warfare\u201d that will require new U.S. policies. Before joining CSIS, Harding served in senior roles at the CIA and the National Security Council.<\/p>\n Why data centers became targets<\/p>\n \u201cData is the new way of war,\u201d Harding said on the latest episode of Generation AI. \u201cYou cannot fight modern war without knowing exactly where you are on the battlefield and where the adversary is on the battlefield.\u201d<\/p>\n She said the advent of AI-powered systems like Maven Smart System requires significant data and compute power, making data centers essential to warfighting efforts. And data centers are relatively soft targets; they\u2019re usually considered civilian infrastructure and are not well defended.<\/p>\n \u201cThey\u2019re big warehouses, basically,\u201d she said. \u201cAnd they don\u2019t necessarily have a lot of defenses around them.\u201d<\/p>\n Lessons from Ukraine<\/p>\n The importance of data centers emerged in the conflict between Russia and Ukraine. Harding said Ukrainians realized early that data centers would be targets of the Russian government, so Ukraine passed a law allowing the country to move data outside to facilities in other countries.<\/p>\n Russia was reluctant to attack those data centers, some of which were in NATO countries, Harding said. Instead, Russia went after them with cyber attacks and attacked data inside Ukraine.<\/p>\n \u201cThe Iranians, however, have had no such compunction,\u201d she said. \u201cThey\u2019ve decided that targets inside the UAE and in Bahrain were legitimate targets if they were data centers that were perhaps aiding the American war effort.\u201d<\/p>\n Are data centers lawful targets?<\/p>\n A strike on a data center at Bank Sepah in Tehran raised questions about whether data centers are lawful targets under international law. Harding said it\u2019s a very difficult legal question.<\/p>\n The bank was responsible for payments to the IRGC. \u201cThat\u2019s a military target, if you look at it that way,\u201d Harding said. \u201cIt also is a bank that serves civilians.\u201d<\/p>\n She said international lawyers will debate whether such targets are dual-use, military or civilian.<\/p>\n \u201cWhat it really does is put data center companies in a position where they\u2019re going to have to think about themselves differently,\u201d she said.<\/p>\n Threats to domestic data centers<\/p>\n Arizona is one of the biggest hubs in the country for data center development. There are 98 data centers currently operating in Arizona and another 86 centers planned or under construction, according to Pew Research.<\/p>\n Harding said there are two ways data centers could be attacked: kinetic attacks and cyber attacks.<\/p>\n It would be a significant escalation for a hostile actor like Russia or Iran to go after a data center inside the United States with a kinetic attack, she said. But cyber attacks are considered far less escalatory.<\/p>\n \u201cThere\u2019s probably a much lower bar to do something like that,\u201d Harding said. \u201cAnd that\u2019s where the U.S. government is going to have to make some decisions about exactly how they view this infrastructure.\u201d<\/p>\n Protecting data centers<\/p>\n Harding outlined three steps the U.S. government can take to protect data centers<\/a>.<\/p>\n First, share more intelligence with data center operators. The government currently has a duty to warn companies if it learns they\u2019ve been targeted, but it\u2019s a high threshold \u2013 the information needs to be \u201cactionable and specific.\u201d Harding said the intelligence community should \u201copen up those taps and share more information.\u201d<\/p>\n Second, act as an insurer of last resort. If insurance companies have clauses voiding coverage in case of war, the U.S. government could serve as a backup insurance provider. That would give tech companies more assurance that their financial assets are covered.<\/p>\n Third, establish deterrence by messaging to adversaries that any attack on a data center will be considered an attack on the United States.<\/p>\n \u201cThe three of these things together, I think, would be a pretty good safety net for these companies,\u201d Harding said.<\/p>\n She also suggested Gulf countries could pass laws loosening restrictions on private actors deploying anti-drone capabilities. That could shift some of the burden of protection off governments and allow companies to more forcefully protect their data centers.<\/p>\n See a spelling or grammatical error in our story? Please click here to report it<\/a>.<\/p>\n