Iran's Data Center Drone Strikes Preview Peril Ahead For Big Tech

Iran’s drone strikes on three of Amazon’s Middle East data centers were the first military attacks on U.S. tech giants’ digital infrastructure — but they likely won’t be the last.

Data centers are becoming priority targets in wartime: critical infrastructure whose destruction can be debilitating to both a country’s economy and military capabilities. 

There are growing concerns among national security analysts that not enough is being done in the U.S. to plan for the likelihood of attacks on Big Tech computing hubs. They say this threat needs to be taken seriously, not just in active conflict zones like the Middle East but also on U.S. soil. 

“This is a harbinger of what’s to come,” said Sam Winter-Levy, a fellow at Carnegie Endowment for International Peace who is focused on the intersection of artificial intelligence and national security. 

“The same way that refineries and energy infrastructure have always been a potential target, so, too, will you see data centers moving up the list of potential targets in a war, especially given that data centers are pretty soft targets. It’s pretty easy to take them out with a couple of cheap drones or with a missile strike and destroy infrastructure without a ton of immediate civilian or collateral damage.”

On the morning of March 1, Iranian drones struck a pair of Amazon Web Services data centers in the United Arab Emirates and one in Bahrain, part of a barrage of drones and missiles fired by Iran at neighboring Gulf states in response to U.S. and Israeli strikes that killed Supreme Leader Ayatollah Ali Khamenei.

The data centers were heavily damaged in the attacks, causing widespread outages of Amazon’s cloud services in the Middle East that persist more than two weeks later. 

Any doubts as to whether Amazon’s data centers were the intended targets were put to rest days later by a social media post linked to Iran’s Islamic Revolutionary Guard Corps reportedly listing Amazon, Google, Microsoft and Oracle among the firms whose facilities it considers “legitimate targets.”

The post was captioned “Enemy's technological infrastructure: Iran's new goals in the region.”

Amazon didn't respond to Bisnow's request for comment. 

Iran’s targeting of U.S.-based tech firms carries symbolic weight in a region where Gulf state governments are realigning their economies around tech and U.S. partnerships. But data centers are increasingly becoming critical strategic targets as well. 

Iran’s attack caused only minor economic disruption, but the UAE and Bahrain are peripheral — if growing — data center markets. A similar strike on the right data centers in major computing hubs in the U.S. could create economic havoc. 

Around 70% of the world’s internet traffic flows through Northern Virginia, and the destruction of just a handful of facilities would effectively close the digital Strait of Hormuz. 

The data center hubs of Northern Virginia and Silicon Valley are far away from current conflict zones, but both Winter-Levy and a November report from the Foreign Policy Research Institute argue that military strikes on U.S. data centers need to be treated as a serious and imminent threat.

The authors of the report were blunt in their assessment that U.S. defense planners and tech firms are unprepared to protect U.S. data centers — along with the infrastructure and supply chains to support them — as critical national infrastructure. 

“[T]hese private-sector behemoths remain perilously exposed,” said the report from FPRI, a national security-focused think tank. “In the digital era, failure to treat data and data centers as national defense assets is a strategic blind spot.”

While a barrage of ballistic missiles may be unlikely, advances in drone technology and tactics have opened new avenues for kinetic strikes far from the front lines.

The Ukrainian military has repeatedly targeted facilities more than a thousand miles into Russian territory using long-range drones. Ukraine has also used short-range drones smuggled into Russia to hit targets that would otherwise be out of range.

The low cost and accessibility of drone technology makes a potential drone attack on a data center from within the U.S. or launched from a nearby country a very real threat, according to Winter-Levy.

Additionally, there is the risk of other forms of unconventional attacks or sabotage from within the U.S.

The U.S. got a small taste of the potential consequences of such an attack in October in an event caused not by a malicious foreign actor but by a software fault. A glitch at a single Amazon Web Services data center in Northern Virginia triggered an outage that took more than 6.5 million websites offline and brought government agencies and corporations across all sectors of the economy to a standstill. 

That partial outage at just one data center, fixed in a matter of hours, caused over $1B in global economic losses.

“These disruptions are not just technical issues, they’re democratic failures,” Corinne Cath-Speth, head of digital for nongovernmental association Article 19, told NBC News. “When a single provider goes dark, critical services go offline with it — media outlets become inaccessible, secure communication apps like Signal stop functioning, and the infrastructure that serves our digital society crumbles.”

The consequences of the physical destruction of one or more critical U.S. data centers by missile or drone strikes could be far greater than a brief outage. 

“Depending on what sort of data center you strike, it can cause significant disruption to a broad range of economic life,” Winter-Levy said. “And if those data centers are being used to conduct intelligence assessments or to help with targeting or the underpinnings of a military campaign, it can be militarily disruptive as well.”

This potential impact on U.S. military might was the focus of the FPRI report, titled Data Centers at Risk: The Fragile Core of American Power.

Military decision-making and intelligence-gathering capability are inextricably reliant on the data centers operated by private-sector tech giants, and a single data center outage could meaningfully degrade the U.S.’s military capabilities, according to the report.

Two of the Department of Defense’s critical networks — the Joint Warfighting Cloud Capability and Joint All Domain Command and Control — use the same infrastructure as commercial cloud services. Intelligence services also rely heavily on the major cloud providers. 

American military power relies just as much on the ready supply of megawatts of computing power as it does on availability of fuel and steel, said the FPRI report. And this dependence on digital infrastructure will only become greater as AI takes on a more central role in warfighting. 

“The boundary between civilian compute and military command has effectively vanished; resilience in one now requires resilience in the other,” the report stated. “Cloud outages have a major impact on the economy, critical infrastructure, and military operations, meaning the security and the functioning of these data centers are a major national security issue.”

There is also the option of “hardening” data centers: making them physically more resilient and less vulnerable to attacks. 

Data centers are already designed to be highly secure and highly resilient mission-critical facilities, with redundant systems, designs meant to withstand natural disasters, and strict access policies.

But experts say the strikes in the UAE and Bahrain highlight a new kind of threat that most data centers weren’t designed to withstand. 

The report argues that the resilience of digital infrastructure needs to be prioritized in defense planning alongside traditional priorities such as energy infrastructure as assets critical to warfighting. Just as there are active drills and war games for how to ensure supplies of fuel and munitions under contested conditions, there needs to be similar regard for securing computing power. 

There also needs to be greater collaboration between Big Tech and military decision-makers to ensure there is a clear mitigation plan if such an attack should occur, and assurances that cloud infrastructure is designed to prevent a single data center from being a point of failure that could cripple the economy and military decision-making, according to the report. 

While the benefit of implementing bunker-like designs or expensive measures such as installing on-site anti-drone systems depends on a data center’s location and the sensitivity of the compute it houses, there is growing sentiment that the highest-risk hyperscale facilities merit extreme measures.

Former White House National Security Council official Chris McGuire told The Guardian this month that if U.S. tech firms are going to continue to build data centers in the Middle East, they may have to spend big to protect them.

“We think about how to protect it right now, and we’re saying, ‘Oh, it means you have guards and good cybersecurity’,” McGuire said. “If you’re actually going to double down in the Middle East, maybe it means missile defence on data centers.”

For tech firms and data center developers, addressing military threats to their infrastructure could bring additional costs amid a trillion-dollar development push. But it could create other headaches as well.

Hyperscalers are already facing a wave of resistance to data center projects in communities across the U.S., and in the wake of Iran’s strikes on AWS facilities, opponents are already pointing to the potential for attack as yet another reason they do not want these facilities near them. 

Data center opponents in established industry hubs like Northern Virginia's Prince William County say they have long been concerned about a potential physical attack — something some view as an inevitability. 

“If you wanted to cause harm, it would be incredibly simple — it doesn’t take much imagination,” said Elena Schlossberg, executive director of the Coalition to Protect Prince William County. “It’s not hyperbolic to suggest that it’s not an if but a when.”