There is now a growing debate over what constitutes war and whether it should include strikes on data centers. They represent a new front in warfare, in which facilities powering the technology behind many critical industries have become targets.
As a result, the definition of a military attack seems to be changing over time.
Conventionally, it was understood to occur when tanks or fighter planes crossed a border. Then it was expanded to include the use of missiles that were fired without crossing the border but hitting a city and causing physical destruction of “vital infrastructure and death”.
Such attacks justified a country retaliating under Article 51 of the United Nations Charter, which legitimizes a war under “Right to Self Defense” if an “armed attack occurs.”
Now there is a growing school of thought that “vital infrastructure” must include any disruptive attack on data centers, whether kinetic or non-kinetic, amounting to significant loss of function. It should be treated as a use of force and trigger the affected country’s right to self-defense under Article 51, the argument goes.
Apparently, vulnerabilities in modern digital infrastructure have turned data centers into primary targets in contemporary warfare. As society becomes deeply integrated with cloud computing, artificial intelligence, and automated logistics, data centers have evolved into the nervous system of modern statecraft.
Attacks on digital infrastructure are no longer limited to cyberattacks (non-kinetic) that cause banking collapses and disrupt vital systems like power grids and hospitals by cutting off Internet access; they now include kinetic strikes on data hubs that affect nations’ military capabilities and expose financial vulnerabilities.
After all, modern defense systems rely heavily on cloud-based logistics. Data centers process satellite imagery, coordinate drone operations, run predictive maintenance algorithms for fighter jets, and host classified communication networks. Thus, taking down these nodes effectively blinds an adversary’s command structure.
This has been noticed in the recent conflicts in the Middle East and Ukraine. For instance, on September 23, Russian Geran-5 jet drones hit the Inkom Business Center in Kyiv, housing Datagroup’s data center. Four people died, and internet service for 100,000 households was down for hours.
On September 27, Kyivstar — Ukraine’s central mobile operator — and Vodafone Ukraine’s data centers were hit. Russia’s Defense Ministry justified this by saying that “Data centers were being used for the benefit of the Ukrainian military.”
Two weeks later, Ukraine returned the favor. It launched highly targeted long-range drone strikes hitting major data hubs across Russia, inflicting significant disruption on the country’s digital economy.
Between October 8 and October 14, 2026, Ukrainian forces carried out a series of “symmetrical responses” to counter earlier Russian attacks on Ukrainian internet and telecommunications assets. The strikes specifically crippled infrastructure belonging to Yandex (often called “Russia’s Google”) and Sberbank, Russia’s largest banking and technology conglomerate.
Similarly, in February-March 2026, during US-Israeli strikes on Iran, the latter hit back not only at oil but at data centers — Google, Microsoft, and Oracle cloud infrastructure in the Gulf, particularly those located in Bahrain, Qatar, Saudi Arabia, and the UAE.
Apparently, when Amazon Web Services’ Bahrain facility suffered “physical damage to cooling infrastructure from debris”, it became the first known case of an AWS data center damaged in an interstate war.
Iranian missiles near Al Udeid Air Base damaged an Oracle Cloud data center in Doha. Microsoft also confirmed “connectivity issues” in the Qatar Central region.
The same happened to the Google data center in Dammam, Saudi Arabia, which hosts Aramco cloud.
G42 [UAE AI company backed by Microsoft] data center in Abu Dhabi was also affected, forcing it into blackout mode.
In other words, from Kyiv to Bahrain, a pattern is clearly apparent — belligerents no longer distinguish between cloud and command. Data centers that host banks and brigades are treated as brigades. They have officially transitioned from commercial tech infrastructures to critical national security assets.
As Omar Sultan Al Olama, the UAE’s Minister of State for Artificial Intelligence, Digital Economy, and Remote Work Applications, said the other day, “Unfortunately, they’re more important than bridges. They’re more important than roads. They’re more important than tunnels because our whole lives are on these devices that we’re using”.
Incidentally, the UAE is revising plans for a 5-gigawatt AI data center project following the Iranian strikes. The original plan envisioned a 10-square-mile campus in Abu Dhabi, to be built in partnership with American tech companies like Oracle, Nvidia, and Cisco. Now the data centers will likely be spread out across the UAE. Sultan Al Olama said, “ The UAE will change its data centre rules and stop promoting where they are”.
According to Kirk Cameron, founding director of the Institute for Advanced Computing at Virginia Tech, “Data centers are now on the critical path for modern digital infrastructure. The loss of key data centers could collapse economies, disrupt public and private transportation with loss of GPS, and affect government essential services for health, emergency dispatch, and power grids.”
Many agree with him when he argues that “Data centers are competitive advantages in warfare. Knocking out capabilities means potentially crippling combat operations for an adversary. It’s also a form of economic warfare and could lead to longer-term competitive challenges for the target.”
All this brings the question of whether bombing a data center constitutes an act of war. Does the definition of war need to change?
The main challenge to this question lies in what is called the “Gray Zone” of conflict, particularly in non-kinetic attacks. Unlike a missile launch, which leaves clear radar signatures and identifiable points of origin, cyber operations offer plausible deniability.
Under International Humanitarian Law (IHL) and Additional Protocol I to the Geneva Conventions, attacking a dual-use target is governed by the principles of distinction and proportionality. Here, attacking a dual-use target is legal only if the military advantage gained outweighs the civilian collateral damage.
If an attack on a data center shuts down military communications but also disables the life-support monitoring systems of dozens of regional hospitals, the strike violates proportionality. Such an operation can be classified as a war crime, reinforcing the argument that major cyber infrastructure operations carry the same legal weight and consequences as traditional warfare.
But any clear distinction in such cases is neither easy nor free from contention. For instance, when Russia attacked data centers in Ukraine, it claimed that these were being used by Ukrainian intelligence and military. However, Ukraine denied the charge.
As Kasia Klonowska, an authority on international law, says, “Due to a lack of a definition of the treaty- terms weapons, means or methods of warfare, it is unclear whether non-weaponized AI decision-support systems should be subjected to a legal review prescribed by Article 36 of the Additional Protocol I. It remains a challenge to determine exactly what should be subjected to review beyond weapons.
“You have very limited situations in which they would actually qualify as lawful targets when they’re used by the military, and even then, it’s very difficult for the attacker to know whether that’s happening or not. If they are purely processing military data, they could be legitimate targets. But many, if not most, are dual-use.”
To address the legal ambiguity surrounding digital warfare, Prof. Ben Hines has proposed what he calls a “Substantive Necessity” framework, reinterpreting international law under Article 51 of the UN Charter.
Under this framework, a non-kinetic cyber attack amounts to an armed attack when the victim state, based on clear and convincing evidence, apprehends a hostile act that has fundamentally compromised, or is imminently poised to compromise, the functioning or security of infrastructure crucial to the state’s ability to function.
The framework argues that traditional international legal thresholds for “force” and “gravity” do not inherently require physical destruction or kinetic weaponry. Under this test, taking down a country’s primary data center cluster that hosts banking, health, emergency dispatch, GPS — even without an explosion — is an armed attack. Because effects equal or exceed kinetic.
Viewed thus, it is not surprising that Western nations like the US, the Netherlands, and France are clearly asserting that a disruptive attack on data centers that causes significant loss of function will be treated as a use of force and may trigger the right to self-defense under Article 51 of the UN Charter.
In sum, as the line between the physical and digital worlds disappears, international law is adapting to treat high-consequence infrastructure attacks as equivalent to an armed attack.
Data centers are now firmly on the front lines of global conflict, where a single breach can serve as the definitive catalyst for war. The lines between civilian infrastructure and military assets are dangerously blurring.
- Author and veteran journalist Prakash Nanda is Chairman of the Editorial Board of the EurAsian Times and has been commenting on politics, foreign policy, and strategic affairs for nearly three decades. He is a former National Fellow of the Indian Council for Historical Research and a recipient of the Seoul Peace Prize Scholarship.
- CONTACT: prakash.nanda (at) hotmail.com
