When data centres become targets

The Gulf states built their AI economies for peacetime. The US-Israeli war with Iran has created a different reality. Data centres, cloud regions, satellite links and cable routes now sit close to active military bases and strategic energy sites. 

These facilities support banks, hospitals and government services, while some may also carry sensitive state workloads. These may include processing security-related data or storing confidential government records. Once a facility serves both civilian and security users, its status becomes harder to read, and the consequences of its failure reach far beyond the battlefield.

The warning is no longer theoretical. Iranian media have argued that assets linked to Elon Musk could become military targets. Another Iranian commentator called for attacks on SpaceX infrastructure if Iranian infrastructure were hit. After damage to Sharif University of Technology's computing centre in Tehran, such language gained force. 

On 21 July, the Revolutionary Guards claimed they had struck Amazon Web Services infrastructure in Bahrain, describing it as part of a US intelligence network. That description remains Iran's claim, but the larger shift is already visible. Commercial computing is being discussed in military language.

The Islamic Revolutionary Guard Corps-linked Tasnim news agency even published a list identifying offices and infrastructure associated with US technology companies, including Google, Microsoft and Nvidia, as potential targets. More recently, Mohsen Rezaei, secretary of Iran's Supreme National Security Council, warned that Iran would target regional cables, data centres and AI facilities if intense fighting resumed. 

A strategic front

An AI system looks weightless on a screen. Its physical base is heavy and fragile. Data centres need uninterrupted electricity, cooling, fibre connections, satellite capacity and skilled maintenance. Gulf facilities are costly, clustered in a limited number of locations across the region, and slow to replace. A strike can disrupt a site without destroying its servers. Damage to a substation, cooling plant or fibre route may be enough. Undersea cables add another weak point; they carry more than 99 per cent of international data traffic and repairs can take weeks. 

Gulf states, in particular Saudi Arabia and the United Arab Emirates, have invested heavily in these technologies to instigate a "digital transformation". Their partnerships with leading US technology firms promise growth and access to scarce computing power. The same geographic concentration that can lower costs through shared power infrastructure, fibre connections and maintenance services in normal times creates a short list of valuable targets during war. 

Recent reporting says the UAE is already reconsidering a huge AI campus in favour of dispersed and more protected facilities after Iranian attacks damaged regional data centres. That is a new stage in AI planning: security architecture is beginning to shape computing architecture. 

Iran has practical reasons to pressure this network. It cannot match US technology or air power, yet it can threaten the confidence on which large digital investments depend. Even a limited disruption can raise insurance prices, delay construction and push customers to move workloads. Financial markets have already begun to price this risk. Musk-linked companies attract attention because satellite links, AI and communications sit close to modern military operations. The issue extends well beyond one billionaire. 

When a data centre is struck, responsibility becomes a major issue. A Gulf data centre may have local land and power, American chips and software, private owners, government clients and users in several countries. If it is attacked, who defends it? Which state decides whether the event is war, sabotage or a commercial loss? Who carries the cost when banks, hospitals and small businesses lose access? Cloud contracts and insurance policies were designed around outages and cybercrime. A missile strike creates a different dispute. 

This ownership gap also complicates deterrence. A strike on a US base has a clear political meaning. A covert cyber operation, damaged cable or attack through a proxy leaves room for denial. Iran could raise costs without confronting American forces directly. Gulf governments and Washington would then face pressure to respond before attribution, ownership and military use were fully established. The delay may restrain escalation; it may also invite another attack. 

Civilian harm is the deeper risk. AI facilities support payment systems, transport, healthcare and public administration. Military use does not erase those civilian connections. Any attacker would still have to judge whether a specific site qualifies as a military objective and whether expected civilian harm is excessive. 

Governments and companies therefore need a clearer separation of sensitive defence workloads from essential public services. Secrecy may protect a client list in peacetime. During war, it can make the whole building look suspect. 

What is required for resilience

Gulf governments should treat data centres as critical infrastructure exposed to war. Protection begins with smaller and more widely distributed facilities, spare electricity and cooling, several cable routes, offline backups and regular recovery exercises. Amazon Web Services organises its cloud infrastructure into separate groups of data centres known as "availability zones". A regional conflict would test whether these zones are far enough apart and whether customers can move data when borders close or governments impose restrictions. 

Governments also need clear rules for facilities that serve civilian and military users at the same time. Sensitive defence workloads should be separated from systems used by banks, hospitals, transport networks and public agencies. Technology companies must explain who will defend privately owned sites, restore damaged services and compensate customers after an attack. These decisions cannot wait until the first missile lands. 

The United States, Israel and their regional partners, particularly governments in the Gulf, should avoid further attacks on Iran's water, electricity, energy and public digital infrastructure. Such attacks make it easier for Tehran to describe similar facilities across the Gulf as legitimate targets. This erodes the protection normally given to civilian infrastructure and make restraint harder for every side. 

The Gulf's AI ambitions will ultimately be judged by whether essential services can survive a serious disruption. Building larger data centres will mean little if one strike can shut down banking, healthcare or public services across several countries. 

Preventing civilian computing from becoming another battlefield should now be a regional priority. Damaged facilities can be rebuilt; restoring confidence in the Gulf as a safe place for technology and investment would take much longer.