When drones strike data centres: how the war has exposed a new vulnerability
The National Interest describes a new challenge in modern warfare: data centres are increasingly viewed not only as part of the digital economy, but also as high-risk infrastructure in the context of armed conflict. The author places them on a par with energy facilities and demonstrates that server capacity today can be just as vulnerable to attack as oil refineries.
As an example, the author cites attacks which, according to his account, took place on 1 March: an Iranian Shahed-136 drone struck an Amazon Web Services data centre in the United Arab Emirates, causing a fire and a power outage. Shortly afterwards, as the text states, another facility was struck, and a third data centre in Bahrain sustained damage following a drone strike nearby. It is precisely these incidents that lead to the main conclusion: digital infrastructure is increasingly becoming part of the landscape of modern military risk.
Iran’s Islamic Revolutionary Guard Corps attributed these strikes to the facilities’ role in supporting hostile military and intelligence operations. This is part of a broader process that has been brewing for years: the largest technology companies are becoming increasingly integrated into defence systems, whilst the infrastructure supporting commercial artificial intelligence, cloud services and analytics is increasingly intertwined with the infrastructure of modern warfare.
This is where the dual-use problem arises. Modern armies are increasingly less likely to operate on a completely isolated military infrastructure. Instead, they use the same commercial cloud platforms as the civilian economy. This applies to the storage of intelligence data, logistical planning, artificial intelligence tools and combat analytics. Consequently, a data centre that simultaneously serves civilian services and military processes finds itself in a grey area, where the line between a civilian asset and a military-significant facility is becoming increasingly blurred.
Data centres are vulnerable not only symbolically, but also economically. Large facilities such as Amazon Web Services, Google Cloud, Microsoft Azure or Meta require years of construction and billions of dollars in investment, but they can be taken out of action very quickly. The main damage lies not only in the cost of recovery. When a data centre goes down, the consequences are instantly felt across banking systems, logistics, healthcare, retail and other sectors that rely on the same physical infrastructure.
Unlike a pipeline or an oil refinery, a data centre is described here as an almost binary entity: it is either operational or it is not. This is precisely why such infrastructure becomes a particularly attractive target for those seeking to inflict maximum damage at a relatively low cost of attack. The text explicitly states that a drone costing around $20,000 can disable a facility worth hundreds of millions.
For the Gulf states, such attacks pose less of a structural problem than a reputational one. For years, the region has promoted itself as a natural hub for the development of new digital infrastructure, relying on three pillars: capital, connectivity and stability. While the first two remain intact for now, the third comes under serious pressure following such attacks.
There are approximately 230 data centres operating in the Middle East, and major technology companies have already invested heavily in the region’s digital projects. However, decisions regarding such infrastructure are made years in advance, and any increase in military risk automatically affects the cost of future investments. This is not about an instant collapse of investment logic, but about the increased cost of risk, which will now have to be factored in much more strictly.
Attacks on data centres do not appear to be isolated incidents. They fit into the same strategic logic as the attacks on energy facilities in Saudi Arabia, Qatar’s LNG infrastructure, and the risks surrounding the Strait of Hormuz. Against this backdrop, data centres become an extension of the same strategy: striking at the pillars of the enemy’s economic resilience – targeting both energy and data simultaneously.
The conclusion is stark: data centres were designed with cyber risks, power cuts and natural disasters in mind, but not state-sponsored air strikes. This is precisely what changes the whole conversation about digital infrastructure. It is increasingly becoming not only an instrument of economic power, but also a target for military pressure. And the line between these two roles will only continue to blur.
