Building an AI data center costs billions. Defending it is another story

Over four days last week, Ukrainian drones struck three data centers operated by Yandex, Russia’s largest technology company. Facilities went offline, disrupting services used by banks, retailers, and ordinary Russians. One of the sites, in Sasovo, housed tens of thousands of servers and two of the supercomputers used to develop Yandex’s AI models.

The strikes followed Russian attacks on Ukraine’s own digital infrastructure, including one that left Kyiv’s Parkovyi Data Center so badly damaged that its operators said the facility could not be restored.

The back-and-forth offers a glimpse of the damage that can be inflicted by attacking the physical infrastructure of the digital economy. And with governments and tech companies pouring billions into the data centers powering AI, including its growing military applications, the stakes are only getting higher.

When I reported from Ukraine this summer, I saw how the country’s military was putting AI to work, from helping drones navigate without GPS to analyzing battlefield intelligence and recommending decisions to commanders. Many of those applications depend on powerful computing infrastructure—and that infrastructure, often housed in enormous buildings full of expensive computers, isn’t particularly hard to find. As the latest strikes show, it isn’t necessarily hard to hit, either.

The problem with hiding data centers

“If the Russians or the Chinese were using AI to accelerate their operations, I would definitely want to target those data centers,” says Jeffrey Lewis, a distinguished fellow at the Foreign Policy Research Institute and professor at the Middlebury Institute of International Studies.

Lewis is particularly concerned about facilities handling AI inference, the process of running trained models. As militaries use AI to analyze intelligence and speed up decisions, the computing power behind those systems could become an inviting target in a major conflict.

Good luck hiding a data center. These things are enormous, consume extraordinary amounts of electricity, and produce enough heat to require elaborate cooling systems. You could bury one underground, Lewis says, but that would be expensive, and it wouldn’t eliminate its dependence on power lines and communications links.

“You can put the whole data center underground, but at some point there has to be a cable or an antenna that brings the data out,” he says. (Moving data centers into space, as several tech giants are now exploring, presents its own problems, namely that the satellites housing servers would also be vulnerable to attack, and a direct hit could create a debris field that threatens other spacecraft.)

The risks haven’t gone unnoticed. A British government assessment warned of physical attacks and the risks of geographically concentrated facilities; a U.S. Government Accountability Office report identified the Pentagon’s Joint Warfighting Cloud Capability program as a mission-critical IT acquisition; and a House Armed Services Committee report called for an examination of the physical and cyber risks of putting commercial AI data centers on military installations.

More recently, RAND researchers proposed a class of highly secure AI inference facilities, though their emphasis was on preventing theft or manipulation of models, rather than surviving drone strikes.

The cost of a direct hit

There’s an uncomfortable economic reality at play, too. Companies are spending billions to build data centers, but disabling them can require far less-expensive weapons.

In March, Iranian drones struck Amazon Web Services facilities in the United Arab Emirates and damaged infrastructure in Bahrain. The strikes disrupted cloud services, and the effects have lingered.

In September, AWS said it could not restore access to resources and data stored exclusively in one affected UAE availability zone or its Bahrain region. Customers with backups elsewhere had ways to recover; those without them faced the prospect of permanent losses.

The attacks are prompting governments to reconsider where data centers belong, says Mehdi Paryavi, chairman and CEO of the International Data Center Authority. “We used to tell people, ‘Don’t build data centers near military targets,’” he says. “Now we’re telling people, ‘Don’t put military bases near data centers.’”

Paryavi says governments around the world are asking his organization whether projects ought to move to safer locations. His preferred approach is to group facilities into a handful of so-called digital hubs, rather than trying to defend thousands of scattered sites.

And sure, concentrating a country’s computing power in a few locations gives an adversary a much shorter list of places to attack, but Paryavi argues that those locations would be far easier to protect. “It’s impossible to secure 50,000 data centers around the country,” he says, “but it’s very easy to secure five locations.”

The trouble with secrecy

Then there’s the question of secrecy. Paryavi argues that publicizing data-center locations creates security risks, but concedes that people living near proposed sites have good reason to demand information about the power and water they’ll consume. “The community concerns are legitimate concerns that need to be addressed,” he says.

And clearly, the risks to civilians extend well beyond power and water use. A strike on a data center could cause relatively few immediate casualties (the buildings are generally sparsely staffed), but the consequences could still prove quite dangerous, disrupting, for example, hospitals and emergency dispatch systems that depend on its computing power. The International Committee of the Red Cross warned earlier this year that data centers used by militaries may, depending on their function, become lawful military targets, even as the laws of war require attackers to account for harm to civilians who depend on the same infrastructure.

The International Committee of the Red Cross warned earlier this year that data centers used by militaries may, depending on their function, become lawful military targets, even as the laws of war require attackers to account for harm to civilians who depend on the same infrastructure.

As AI becomes increasingly important to military operations, the incentive to attack the infrastructure powering it will only grow. This is, Lewis argues, a fairly predictable consequence of technological progress, even if governments aren’t necessarily prepared for it. “When you discover something is valuable,” he says, “you then create the incentive for people to target it.”