First intentional military attack on a civilian data center in war history

For the first time in military history, a private company's data center became the target of an intentional military attack. The Iranian Revolutionary Guard Corps (IRGC) carried out suicide drone attacks on Amazon-owned data centers located in the United Arab Emirates (UAE) and Bahrain.

According to Amazon, the attack "caused structural damage, disrupted power to infrastructure, and caused additional water damage in some facilities while fighting fires." As a result, Amazon Web Services (AWS) service failures occurred throughout the Middle East.

Iran's state broadcaster revealed the motive for the attack, explaining that it was to highlight "the role of these facilities in supporting military and intelligence activities of enemy countries." The semi-official Tasnim news agency pointed out dozens of local facilities owned by Microsoft, Google and others as “enemy technology infrastructure,” suggesting they could be targets of attacks.

Why did data centers become military targets?

The core of this incident is that big tech companies are no longer simply private businesses. Amazon, Google, and even Facebook parent company Meta are active partners with the U.S. Department of Defense, contributing to the military's build-up.

Experts in international law and the law of armed conflict analyze that when the military relies on cloud infrastructure, the cloud can become a legitimate military target. Leon Castellanos-Jankiewicz, a lawyer at the Arthur Institute for International and European Law in The Hague, Netherlands, explained that "legality is determined by whether a particular facility contributes substantially to the military operations of a party to the conflict and whether it provides a specific and clear advantage to the attacker."

The problem is that 'cloud' is an abstract concept, not a physical place. A global network consisting of millions of chips distributed across hundreds of large buildings around the world simultaneously serves private apps and state tools for surveillance and killing. Separating civilian and military uses is an extremely difficult task.

Combination of Big Tech and Military-Industrial Complex: When did this happen?

The convergence of technology companies and the military sector has accelerated rapidly in recent years. Microsoft supports the operation of the US Department of Defense's 'Joint Warfighter Cloud Capability (JWCC)', and the Department of Defense has stated that it has secured "greater lethality" through this. The work involves processing classified data, which the government wants to keep separate from civilian technology.

Cloud services are generally provided through geographically separated ‘regions’. Microsoft's 'US DoD Central' and 'US DoD East' regions are "dedicated to the Department of Defense" and are managed by data centers in Des Moines, Iowa, and Northern Virginia, respectively. Amazon also operates a cloud region dedicated to the Pentagon, but the exact location is private. Oracle operates facilities dedicated to the Department of Defense in Chicago, Phoenix, and Virginia.

However, the problem is that this separation is not perfect. The same company provides both civilian and military services, and it is difficult to determine from the outside how much of the physical infrastructure is for military use and how much is for civilian use.

Future outlook [AI analysis]

This Iranian attack foreshadows aspects of future war. There are several important implications.

First, the militarization of big tech infrastructure is likely to accelerate. As cloud-based artificial intelligence (AI) has become a key element of military operations, data centers have acquired the same strategic value as military factories or fighter jet production facilities of the past.

Second, international legal debate is expected to intensify. Controversy surrounding the legality of attacks on civil-military facilities may require a fundamental review of the existing laws of war. There is a need for international agreement on when and under what conditions data center attacks are justified.

Third, Big Tech companies are likely to face a dilemma. They may be forced to choose between profits from government contracts and the security of global infrastructure. Some companies may withdraw from military contracts or, conversely, move toward strengthening facility security to military levels.

Fourth, investment in data centers in areas of geopolitical tension may decline. There may be a reluctance to build large-scale data centers in areas with the potential for conflict, such as the Middle East and East Asia, and this may affect the development of digital infrastructure in those regions.

This incident shows that digital infrastructure is no longer the background to war, but has become the stage of war. In an era where companies known for e-commerce, social media, and search engines have become military collaborators, the question of whether bombing servers is a justifiable act of war has now become a practical issue rather than a theoretical assumption.