Prakash Nanda
There is now a growing debate over what constitutes war and whether it should include strikes on data centers, as they represent a new front in warfare, in which facilities powering the technology behind many critical industries have become military targets.
As it is, the definition of a military attack seems to be changing over the years. Conventionally, it was understood to occur when tanks or fighter planes crossed a border. Then it was expanded to include the use of missiles that were fired without crossing the border but hitting a city and causing physical destruction of “vital infrastructure and death”.
Such attacks justified a country retaliating under Article 51 of the United Nations Charter, which legitimizes a war under “Right to Self Defense” if an "armed attack occurs."
Now there is a growing school of thought that “vital infrastructure” must include any disruptive attack on data centers, whether kinetic or non-kinetic, amounting to significant loss of function. It should be treated as use of force and trigger the right of the affected country to self-defense under Article 51, so runs the argument.
Apparently, the vulnerability of modern digital infrastructure has transformed data centres into primary strategic targets in contemporary warfare. As society becomes deeply integrated with cloud computing, artificial intelligence, and automated logistics, data centres have evolved into the nervous system of modern statecraft.
And here, attacks on digital infrastructures are not limited to cyber attacks(non-kinetic) that cause banking collapse and disruptions of vital systems like power grids and hospitals by cutting access to the Internet; they have become physical kinetic strikes on physical data hubs, affecting nations’ military capabilities along with financial vulnerabilities.
After all, modern defense systems rely heavily on cloud-based logistics. Data centres process satellite imagery, coordinate drone operations, run predictive maintenance algorithms for fighter jets, and host classified communication networks. Thus, taking down these nodes effectively blinds an adversary's command structure.
This has been noticed in the recent conflicts in the Middle East and Ukraine. For instance, on September 23, Russian Geran-5 jet drones hit the Inkom Business Centre in Kyiv, housing Datagroup's data center. Four died, and the internet for 100,000 households was down for hours.
On September 27, Kyivstar — Ukraine's central mobile operator — and Vodafone Ukraine's data centers were hit. Russia's Defence Ministry justified this by saying that "Data centers were being used for the benefit of the Ukrainian military."
Two weeks later, Ukraine returned the favor. It launched highly targeted long-range drone strikes hitting major data hubs across Russia, inflicting significant disruption on the country's digital economy.
Between October 8 and October 14, 2026, Ukrainian forces executed a series of "symmetrical responses" to counter previous Russian attacks against Ukrainian internet and telecommunication assets. The strikes specifically crippled infrastructure belonging to Yandex (often called "Russia's Google") and Sberbank, Russia's largest banking and technology conglomerate.
Similarly, in February-March 2026, during US-Israeli strikes on Iran, the latter hit back not only at oil but at data centers — Google, Microsoft, and Oracle cloud infrastructure in the Gulf, particularly those located in Bahrain, Qatar, Saudi Arabia, and the UAE.
Apparently, when Amazon Web Services’ Bahrain facility suffered "physical damage to cooling infrastructure from debris", it became the first known case of an AWS data center damaged in an interstate war.
Iranian missiles near Al Udeid Air Base damaged an Oracle Cloud data center in Doha. Microsoft also confirmed "connectivity issues" in the Qatar Central region.
So was the case with the Google data center in Dammam in Saudi Arabia that hosts Aramco cloud.
G42 [UAE AI company backed by Microsoft] data center in Abu Dhabi was also affected, resulting in it being moved to blackout mode.
In other words, from Kyiv to Bahrain, a pattern is clearly apparent — belligerents no longer distinguish between cloud and command. Data centers that host banks and brigades are treated as brigades. They have officially transitioned from commercial tech infrastructures to critical national security assets.
As Omar Sultan Al Olama, the UAE’s Minister of State for Artificial Intelligence, Digital Economy, and Remote Work Applications, said the other day, “ Unfortunately, they’re more important than bridges. They’re more important than roads. They’re more important than tunnels because our whole lives are on these devices that we’re using”.
Incidentally, the UAE is revising plans for a 5-gigawatt AI data center project following the Iranian strikes. The original plan envisioned a 10-square-mile campus in Abu Dhabi, to be built in partnership with American tech companies like Oracle, Nvidia, and Cisco. Now the data centers will likely be spread out across the UAE. Sultan Al Olama said, “ The UAE will change its data centre rules and stop promoting where they are”.
According to Kirk Cameron , founding director of the Institute for Advanced Computing at Virginia Tech, “Data centers are now on the critical path for modern digital infrastructure. The loss of key data centers could collapse economies, disrupt public and private transportation with loss of GPS, and affect government essential services for health, emergency dispatch, and power grids.”
Many agree with him when he argues that “Data centers are competitive advantages in warfare. Knocking out capabilities means potentially crippling combat operations for an adversary. It’s also a form of economic warfare and could lead to longer-term competitive challenges for the target.”
All this brings the question of whether bombing a data center constitutes an act of war. Does war's definition need to change?
The main challenge to this question lies in what is said to be the "Gray Zone" of conflict, particularly when it is a non-kinetic attack. Unlike a missile launch, which leaves clear radar signatures and geographical points of origin, cyber operations are characterized by plausible deniability.
Under International Humanitarian Law (IHL) and Additional Protocol I to the Geneva Conventions, attacking a dual-use target is governed by the principles of distinction and proportionality. Here, attacking a dual-use target is legal only if the military advantage gained outweighs the civilian collateral damage.
If an attack on a data centre shuts down military communications but concurrently disables the life-support monitoring systems of dozens of regional hospitals, the strike violates the principle of proportionality. Such an operation can be classified as a war crime, reinforcing the argument that major cyber infrastructure operations carry the same legal weight and consequences as traditional warfare.
But any clear distinction in such cases is neither easy nor free from contention. For instance, when Russia attacked data centers in Ukraine, it claimed that these were being used by Ukrainian intelligence and military. However, Ukraine denied the charge.
As Kasia Klonowska, an authority on international law, has said,“Due to a lack of a definition of the treaty- terms weapons, means or methods of warfare, it is unclear whether non-weaponized AI decision-support systems should be subjected to a legal review prescribed by Article 36 of the Additional Protocol I. It remains a challenge to determine exactly what should be subjected to review beyond weapons.
“You have very limited situations in which they would actually qualify as lawful targets when they're used by the military, and even then, it's very difficult for the attacker to know whether that's happening or not. If purely processing military data, then they could be legitimate targets. But many, if not most, are dual-use."
On the other hand, reinterpreting international law under Article 51 of the UN Charter to address the legal ambiguity surrounding digital warfare, Prof. Ben Hines has proposed what he calls a "Substantive Necessity" framework.
Under this, a non-kinetic cyber attack amounts to an armed attack when the victim state, based on clear and convincing evidence, apprehends a hostile act that has fundamentally compromised, or is imminently poised to compromise, the functioning or security of infrastructure crucial to the state's ability to function as such.
The framework argues that traditional international legal thresholds for "force" and "gravity" do not inherently require physical destruction or kinetic weaponry. Under this test, taking down a country's primary data center cluster that hosts banking, health, emergency dispatch, GPS — even without an explosion — is an armed attack. Because effects equal or exceed kinetic.
Viewed thus, it is not surprising why Western nations like the US, the Netherlands and France are clearly asserting that a disruptive attack on data centers amounting to significant loss of function will be treated as use of force and may trigger the right to self-defence under Article 51 of the UN Charter.
In sum, as the line between the physical and digital worlds disappears, the definition of warfare is adapting to the rapidly evolving international law that treats high-consequence infrastructure attacks as equivalent to an armed attack.
The data centres are now firmly positioned on the front lines of global conflict, where a single breach can serve as the definitive catalyst for war. Lines between civilian infrastructure and military assets are dangerously getting blurred.
(prakash.nanda@hotmail.com)
Leave Your Comment