Data Centers Are Military Targets Now |
Special Investigations
Press Freedom Defense Fund
Data Centers Are Military Targets Now
With militaries increasingly relying on artificial intelligence, data centers have emerged as new targets for strikes.
In retaliation for the ongoing U.S.–Israeli war, Iran responded with a novel form of counterattack. For the first time in military history, private sector data centers came under deliberate attack.
In an era when companies known for e-commerce, social networks, and search engines have also become close collaborators with militaries, is bombing their servers fair game?
Three days after the U.S. and Israel began their joint bombardment, the Islamic Revolutionary Guard Corps launched kamikaze drone strikes against Amazon-owned data centers in the United Arab Emirates and Bahrain that provide an array of cloud computing services to customers throughout the Middle East. The impacts and subsequent fires “caused structural damage, disrupted power delivery to our infrastructure, and in some cases required fire suppression activities that resulted in additional water damage,” according to Amazon, resulting in service outages across the region.
The motive behind the attack, according to Iranian state television, was not to block people from ordering groceries or posting to social media, but rather to highlight “the role of these centers in supporting the enemy’s military and intelligence activities.” Though only Amazon’s centers are known to have come under fire, a March 11 tweet from the quasi-official Tasnim News Agency listed dozens of regional facilities, including data centers owned by Microsoft, Google and others, deemed “Enemy Technology Infrastructure” suitable for targeting.
It’s unclear if the Amazon data centers struck by Iranian drone strikes are used for military purposes or civilian purposes, or both. And it’s unknown if the attacks in any way hindered the militaries of the U.S., Israel, or their allies in the Gulf from using AI or other cloud-based services in their war efforts. But with Amazon, Google, and even Facebook parent company Meta are all eager partners of the Pentagon that augment the destructive power of the United States in Iran and elsewhere, server farms may now have the same status as factories building bombs and warplanes.
Scholars of international law and the laws of armed conflict say that when a military runs on the cloud, the cloud becomes a legal military target. But the cloud is an abstraction, not a physical site — a global network of millions of chips in servers spread across hundreds of massive buildings across the planet, servicing both civilian apps and state tools used to surveil and kill. Separating the former from the latter is an extremely difficult task.
“The legality turns on whether the specific facility, at the specific moment, is genuinely serving the military operations of a party to the conflict in a way that offers a concrete and definite advantage to the attacker,” explained León Castellanos-Jankiewicz, a lawyer with the Asser Institute for International and European Law in The Hague.
Sometimes the split between military and civilian use is straightforward. Microsoft, for example, helps run the Joint Warfighter Cloud Capability, which the Pentagon says provides it with “greater lethality.” This work involves the processing of classified data, which the government does not want commingling with civilian tech. Cloud computing services are generally offered via geographically distinct “regions,” each made up of many physical data centers. Customers typically select the region that is closest to them to minimize lag time. Microsoft’s US DoD Central and US DoD East regions are “reserved for exclusive [Department of Defense] use,” according to the company, and are serviced by data centers in Des Moines, Iowa, and Northern Virginia, respectively.
Amazon offers similar cloud regions exclusive for Pentagon use, though the location of these data centers is not public. Oracle, another JWCC provider, operates Pentagon-specific facilities in Chicago, Phoenix, and Virginia. Companies are understandably tight-lipped about where exactly........