Drone Strikes on Data Centers Expose Vulnerability of Gulf's AI Infrastructure Ambitions

'It means missile defence on data centres': drone strikes raises doubts over Gulf as AI superpower

Iran's targeting of commercial datacentres in the UAE and Bahrain signals a new frontier in asymmetric warfare It is believed to be a first: the deliberate targeting of a commercial datacentre by the armed forces of a country at war. At 4.30am on Sunday morning, an Iranian Shahed 136 drone struck an Amazon Web Services datacentre in the United Arab Emirates, setting off a devastating fire and forcing a shutdown of the power supply. Further damage was inflicted as attempts were made to suppress the flames with water. Soon after, a second data centre owned by the US tech company was hit. Then a third was said to be in trouble, this time in Bahrain, after an Iranian suicide drone turned to fireball on striking land nearby. Iranian state TV has claimed that Iran's Islamic Revolutionary Guard Corps launched the attack "to identify the role of these centres in supporting the enemy's military and intelligence activities". The network built by Jeff Bezos's company could withstand one of its regional centres being taken out of action but not a second, let alone a third of their huge warehouses of technology. The coordinated strike had an immediate impact. Millions of people in Dubai and Abu Dhabi woke up on Monday unable to pay for a taxi, order a food delivery, or check their bank balance on their mobile apps. Whether there was a military impact is unclear - but the strikes swiftly brought the war directly into the lives of 11 million people in the UAE, nine out of 10 of whom are foreign nationals. Amazon has advised its clients to secure their data away from the region. Perhaps more significantly, the strikes on this 'next generation' war target are now raising questions about the prospects of the UAE building on its plans, and many billions of pounds worth of US and other foreign investment, to exploit what they hope will be the 'new oil': artificial intelligence (AI). "The UAE really wants to be a major AI player," said Chris McGuire, an AI and technology competition expert who served as a White House national security council official in Joe Biden's administration. "Their government has very strong conviction about this technology, probably stronger than any other government in the world, and if there's going to start to be security questions around that, then they're going to have to resolve those very quickly, somehow." A datacentre is a facility designed to store, manage, and operate digital data. The growing demand by businesses for artificial intelligence (AI) and cloud computing - where firms have a pay-as-you-go relationship with the providers of servers, storage and software - is driving the need for centres that have significantly more computational power. It requires a ready and consistent supply of very cheap electricity. The UAE, as it seeks to diversify away from fossil fuels, has been able to point out that it has this in spades, along with a huge sovereign wealth fund ready to invest and subsidise projects. According to Turner & Townsend's Global Data Centre Index, the overall global cost increase of datacentre construction increased in 2025 by 5.5% - but the UAE ranks 44th in the league table of most expensive unit cost per watt out of 52. The UAE's geography also makes it a critical subsea cable landing point, providing access between Europe and Asia. Then there are the geo-politics, with the US keen to keep the Gulf states away from Chinese technology. A four-day tour by Donald Trump of Saudi Arabia, Qatar, and the UAE last May coincided with the announcement of the construction of a vast new AI campus - a partnership between the UAE and the US - for the purpose of training powerful AI models. As part of the deal, the Trump administration eased restrictions on advanced chips sales to the Gulf. OpenAI has said the planned UAE campus could eventually serve half the world's population. McGuire said that this week's events could be pivotal. "If we're going to have large scale datacentres built out in the Middle East, we're going have to get pretty serious about how we protect them," he said. 'We think about how to protect it right now, and we're saying, 'Oh, it means you have guards and good cybersecurity'. "If you're actually going to double down the Middle East, maybe it means missile defence on datacentres." Sean Gorman, the chief executive of Zephr.xyz, a technology firm that is a contractor to the US air force, said that the Gulf states' ambitions would have likely been in the thoughts of military planners in Tehran. He said: "I believe the Iranians are building on tactics they've seen be effective in the Ukraine conflict. Asymmetric warfare that can target critical infrastructure creates pressure on adversaries by disrupting public safety and economic activity. "UAE and Bahrain have both been positioning themselves as global AI hubs by investing heavily in datacentres and fibre infrastructure to connect them to the rest of the world. "If they can disrupt that infrastructure, it puts their strategic position under risk while also disrupting operations that are important to the economy. In addition, there could be an adjacent impact of defence operations, but that would likely be more luck than the primary objective." Gorman said the UAE had a "long track record of managing regional instability without becoming party to it" but that there were a range of risks apart from that from the air. He said: "The UAE also has one of the most diversified submarine-cable landing environments in the Middle East, but the diversity is geographically uneven. "There are multiple landing stations and cable systems, but many of them concentrate on the east coast at Fujairah, which creates a partial geographic chokepoint. "In addition, there is a specific risk from Iranian cyber operations targeting US-aligned digital infrastructure in the Gulf, which presents a more concrete near-term threat to datacentre and cloud operations than geography in the traditional sense." Gorman said the concern would be if Iran demonstrated any further capability to target Gulf digital infrastructure as part of its retaliation. He said: "The UAE will need to show partners that its infrastructure is defensible. This is the question investors should be asking, not whether the broader AI ambition survives." Vili Lehdonvirta, senior fellow at the Oxford Internet Institute, University of Oxford, said there were significant costs to such defences but that the danger was real. The former chair of the US National Security Commission on AI, Eric Schmidt, suggested last year that a country falling behind in an AI arms race could bomb their adversary's datacentres. Lehdonvirta said he suspected that no one actually believed that datacentres "would get bombed despite such scenarios being openly floated for some time". "If that's the case then from now on we might perhaps see operators of prominent datacentres like AWS [Amazon Web Services] investing in air defence, similar to how shipping operators armed up against pirates," he said. Where might Iran fruitfully strike next? "The Iranians will be well aware that the fibreoptic cables that connect these datacentres to the United States and to the rest of the world run through the strait of Hormuz," Lehdonvirta said, "although they'll be closely watched by the US and allied forces."

Big Tech's uncertain future in the Persian gulf

Gulf nations like the UAE and Bahrain attracted US tech firms and capital for AI infrastructure. These investments, crucial for diversifying economies away from oil, now face severe risks. Attacks on data centres and undersea cables highlight the new dangers. The conflict has shaken investor confidence and raised concerns about the future of trillions of dollars in the region. For years, Persian Gulf monarchies like the United Arab Emirates, Bahrain and Qatar have lured US tech companies and Wall Street capital to team up on projects, dangling friendly investment terms and opulent office hubs with luxury towers, cappuccino bars and bikini-friendly beach clubs. Deploying their giant sovereign wealth funds, the governments of these countries have moved aggressively to break their overwhelming dependence on oil and gas revenues. And investors, seeking lucrative new markets, have rushed to oblige. Silicon Valley, in particular, has bought into the Persian Gulf. Tech giants including Nvidia, Microsoft and Oracle all poured money into large-scale facilities across the region, including data centers to power their enormous and growing bets on artificial intelligence. But the war with Iran suddenly threatens to undermine that cozy business relationship. The scope of the conflict has stunned the Gulf nations and their Western business partners over the past week, and raised serious questions for both about the future of these investments -- with trillions of dollars hanging in the balance. After the United States and Israel launched coordinated strikes against Iran last weekend, the Iranians' response included attacks against nonmilitary targets in countries across the region. Iranian drones hit two Amazon Web Service data centers in the UAE and damaged one in Bahrain earlier in the week. Schools and offices have gone remote. The United States shut its embassies in Kuwait, Lebanon and Saudi Arabia. On Thursday, a billionaire businessman in Dubai lashed out at President Donald Trump on social media for starting the war. The Financial Times reported on Friday that a handful of Gulf states were considering whether to pull back on overseas investments because of the financial impact of the conflict. Anxiety is "through the roof," Mona Yacoubian, Middle East program director at Washington's Center for Strategic and International Studies, said, describing the mood at an iftar dinner in Washington this week. Trillions of Dollars in Play For Western investors, the stakes have been rising as AI spending surges in the Persian Gulf. Stargate UAE, operated by OpenAI and Oracle and powered by top-line Nvidia chips, started in May with a splashy ceremony in Abu Dhabi, featuring OpenAI's Sam Altman and Nvidia CEO, Jensen Huang. It is set to be the world's biggest data center outside the United States. In December, the State Department unveiled "Pax Silica," a declaration signed by 11 countries, including Israel, the UAE and Qatar, pledging to coordinate development of AI infrastructure. Gulf countries could be an important part of the build-out, given their prized advantages: Wedged between Asia, Africa and the Middle East, and a middle distance from Europe, the region has plentiful land, cheap electricity and willing populations. Data centers have already proliferated across the Persian Gulf, with 61 in Saudi Arabia and 57 in the Emirates, according to DataCenter Map, an industry intelligence tool. All that makes the Gulf "an emerging epicenter of AI infrastructure globally," Yacoubian said. But risks that seemed remote a week ago now look far more real -- with the potential to spread beyond the region. "The vulnerability is no longer hypothetical," said Kristian Alexander, senior fellow and lead researcher at the Rabdan Security & Defense Institute in Abu Dhabi. Undersea Cables Are Sitting Ducks Among the highest risk factors could be the fiber-optic cables that snake under the Strait of Hormuz and the Red Sea -- the region's two choke points, not only for oil shipments but for data, too. Among the world's most concentrated digital corridors, they are crucial to keeping parts of Europe and Asia connected to the internet, and experts fear they could be sabotaged, or entangled or dislodged amid chaotic fighting. Such an event has already occurred. In 2024, four major Red Sea undersea cables were damaged when Houthi rebels struck a ship, disrupting about a quarter of the data traffic linking Europe and Asia, including the Middle East. Although data was quickly rerouted, it took months to fully restore the cables. "It shows how quickly connectivity can be degraded, rather than fully go dark," Alexander said. Land-based infrastructure could also be at risk. On Tuesday, debris from intercepted Iranian drones fell into an oil storage area in Fujairah, a UAE port city that is also the site of a major cable hub. That underscored the twin threats that the tech and AI ecosystem now faces: cyberattacks that can be launched remotely, and wartime strikes that can hit directly. "The threat picture is now blended," Alexander said. A Reality Check Until a week ago, the violent risks seemed far-fetched. "Before Feb. 28, the assumption was that a cyber risk was constant but kinetic risk was low probability," Alexander said. Indeed, for years, investors in the Persian Gulf have felt worlds removed from the Middle East's political strife. But to some observers, that feeling of safety seemed to be an illusion. In 2023, two weeks before Hamas waged a massacre on Israelis, setting off the Gaza war, Matt Gertken, chief geopolitical analyst for BCA Research, traveled to the Gulf to meet with hedge funds and other Western investors. He offered a dire warning, telling them that the Israelis appeared set to bomb Iran's nuclear facilities at some point, and that the United States was likely to join them. That could lead to a widening regional war, he told them, potentially threatening their business -- perhaps even their Gulf lifestyle. Investors were deeply skeptical. "I do geopolitical forecasting for a living," Gertken said. "But I was sensitive to the fact that I was in Dubai saying: 'You know, things are going to get bad for a while. It is not what people wanted to hear. It was very contrarian." This week has shifted the calculus. Alexander said Gulf officials were considering how to harden defenses of their data centers and tech networks, including possibly engineering new infrastructure to withstand missile strikes rather than just cyberattacks, which were regarded as the main vulnerability until now. "The risk was understood in strategic circles," Alexander said. "But many mitigation efforts were still oriented towards cybersecurity." In just one week, the war has greatly expanded the risks. This article originally appeared in The New York Times.

When clouds get hit by drones: As data centres become target of strikes, there is one more critical infrastructure to protect

Recent drone strikes during the Iran-US-Israel conflict reportedly damaged cloud data centres operated by Amazon Web Services in the UAE and Bahrain, raising concerns that the physical infrastructure of the internet could become targets in warfare. Traditionally seen as remote digital utilities, these facilities are critical hubs powering governments, banking systems and AI services. Cloud is a rather soft, non-techie word for what it really is -- server farms that are the digital backbone of the world. But that fluffy idea of data residing far away, ready to turn up at your command has suddenly been shattered. Geopolitics happened. Drones turned up. Last week, right after Israel and US attacked Iran, Tehran retaliated. And by design or by accident, cloud computing facilities operated by Amazon Web Services in the United Arab Emirates and Bahrain were damaged in drone strikes. Then news emerged that Microsoft Azure's data centres might have also been targeted. And just like that, those dark, windowless warehouses, which guzzle electricity and water while powering everything from government to global banking to AI algorithms, were no longer just peripheral backend utilities. They had become the front-end of traditional war. It wasn't that clouds were immune to geopolitical machinations earlier, but that risk was primarily cyber. What happened in UAE and Bahrain was among the first known instances of the physical location of a data centre coming in the line of fire in a war. This has major implications. The likes of Goldman Sachs, JLL and PwC project that the total cumulative investment in data centres will exceed $3 trillion by 2030, with that figure potentially doubling by 2035. There is big money at stake. More importantly, with every facet of life being disrupted by data and AI, a data centre going offline has real-life implications on everything from hospitals to traffic management to water treatment. The possibility of civilian harm, beyond the concrete and the silicon of data centres, is very real. PROTECTING DATA First things first, it has yet to be ascertained if the Iranians really targeted the facilities, or if they were struck by accident. As strategic analyst KP Nayar points out, "Iran is using missiles which are not very sophisticated." He is of the opinion that Iran may have been targeting large facilities randomly. Even if these strikes were accidental, future ones may not be. That makes this a significant moment, one that should make decision-makers, in government, military and private sector, sit up and take notice. The world runs on data almost as much as it does on oil, and while the reliance on the latter may eventually wane, the centrality of the former to the modern way of life is just beginning. If attacks on data centres this time were acts of randomness, it might not remain that way for longer. New York-based Soufan Center, a nonprofit that researches security challenges, recently warned that the physical infrastructure of AI could become a target. In a research note, it said "we must also recognize that these assets could become targets for domestic actors and that possible synergies between extremists and foreign adversaries could amplify the threat". Data centres are the oil refineries of the 21st century, and undersea internet cables that connect continents are the oil tankers. There have been several instances in the recent past of the latter being cut during geopolitical events. Multiple telecom and power cables in the Baltic were damaged between 2023 and 2024, with suspicions from the Scandinavian countries pointing to heightened tensions with Russia, after the latter attacked Ukraine. A similar story had played out in the Black Sea during the Russian annexation of Crimea in 2014, and in the Red Sea during the 2024 tensions in West Asia. There have also been reports of Taiwan fearing that China would cut internet cables to the island nation. In a manner of speaking, attacking information channels used to happen earlier too, with the British cutting German telegraph cables during World War I. If cutting cables affected only transmission, it is the storage of data, which underpins modern commerce and economy, that is now under threat. India, like countries in the West, does classify data centres as national critical infrastructure especially if they host government data. In fact, it does fall under the purview of the National Critical Information Infrastructure Protection Centre (NCIIPC). But this again is from a cyber resilience point of view, and less from physical warfare. In many parts of the world, there would also be a very real threat of terrorism, and it is also important to ask if that is taken into account when putting up multibilliondollar data centres. REDESIGNING THE CLOUD While it may not be possible to install missile shields in data centres, there are steps that need to be taken to mitigate risks, especially from the point of view of cloud architecture. How should countries -- and companies -- save their data? While it is good to have backup in multiple data centres, should they be in the same region? For years, redundancy planning focused on natural disasters. For example, traditionally, two seismic zones were chosen to save data in, but if they are both in the same country both become a target to be taken out if an enemy so chooses. That would then necessitate a slight rethink of the concept of data residency legislations that restrict data storage and processing of that data to geographical boundaries. It is more food for thought for a generation of CIOs and CEOs. Would it be a good idea to locate data centres in less conflict-ridden countries? For example, would these attacks force a rethink among cloud companies to locate their data centres away from West Asia, which has for long been mired in conflict? A paper by Ian Saunders, visiting fellow at Cranfield University, UK, poses another critical question: "should there be a minimum resilience security standard for physical critical infrastructure?" GLOBAL NORMS Here is a larger question. Are data centres, especially those used by the government torun AI models for war, fair targets? Last month, The Wall Street Journal had reported that the US military had used Claude, an AI model from Anthropic, in its operation to kidnap Nicolas Maduro from Venezuela. Going by the keenness of the US Department of Defense (or War, per Donald Trump) and their recent tugof-war with Anthropic for the usage of Claude, it is clear the use of AI during war is here to stay. In that context, equations become a little more complicated. If ports, roads and railway lines used by the military are fair game, why not data centres? This certainly would be the point of view of the aggressor. The international order has rules that govern the targeting of civilians and civilian infrastructure, and those need to be upheld. The UN norms of responsible state behaviour in cyberspace already says, "A State should not conduct or knowingly support ICT (Information and Communication Technologies) activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public." At the moment, this might be restricted to ICT activities -- read hacking -- but there is clearly scope to make this stronger, and bring physical attacks too into the purview. What is required then are multilateral dialogues that look at the broad contours of harms that digital infrastructure could sustain in the context of conflict, including attacks on power sources, and build consensus on what constitutes legitimate military targeting and what doesn't.