AI data centers are now military targets, and most countries have no plan

Iran struck three Amazon Web Services data centers in the UAE and Bahrain in February, then damaged an Oracle facility in Dubai a month later. Weeks after, its military declared eighteen major technology companies, including AWS, Microsoft, Meta, Google, and Oracle, as legitimate military targets. A new analysis from the Modern War Institute at West Point calls that sequence the clearest public evidence yet that AI-era data centers have become targets in modern warfare.

The piece, written by Jason Vogt and Nina A. Kollars of the US Naval War College's Cyber and Innovation Policy Institute, argues that the rapid build-out of AI training and inference campuses is creating a new class of strategic target. The same physical features that make a hyperscale data center efficient, including a fixed location, a power draw measured in hundreds of megawatts, and a tight dependence on water and fiber, also make it a sitting duck for state and nonstate attackers. The authors are blunt: data centers are now key terrain, and military planners need to treat them the way they treat ports, airfields, and rail hubs.

What the data center build-out concentrates in one place

The numbers in the MWI analysis explain why militaries care. A traditional non-AI data center can run on twenty megawatts, about the load of fifteen to twenty thousand US homes (the same kind of load that drove a 76% power spike on America's largest grid in early 2026). An AI training cluster with more than 100,000 Nvidia GPUs can pull 150,000 megawatts at peak, and a single upcoming training run is projected to need a full gigawatt, enough to power a city. A modern AI rack draws more than one hundred kilowatts, compared to five to fifteen for a CPU-only rack, and the cooling loop for that hardware can swallow five million gallons of water a day.

Concentrating that much compute, power, and water in one place is a deliberate engineering choice. AI training needs the GPUs to be physically close so the network fabric can move gradients between them at terabit speeds. That same proximity is what makes the campus a target. An adversary does not need a precise cyber weapon to degrade US or allied AI capacity. A drone swarm, a cruise missile, a sabotage team at a substation, or a single disgruntled contractor with a wrench can do as much damage as a sophisticated exploit.

The build-out pattern makes the problem worse. The MWI authors document a wave of so-called digital megacampuses: an eleven-gigawatt site in Texas, a 13,000-acre, 7.2-gigawatt facility in Montana, a $16 billion site in Michigan, and a proposed 40,000-acre campus in rural Utah with its own dedicated natural gas pipeline feeding a nine-gigawatt power station. In Europe, Nordic countries with cheap hydropower and cool air, including Sweden, Norway, and Finland, are absorbing much of the new capacity. In the Middle East, Saudi Arabia and Oman are committing to multi-gigawatt builds. Each of these projects concentrates trillions of dollars of compute, and the jobs and tax base that follow it, into a small number of fixed sites.

Three theaters where the new target class is already playing out

The MWI paper walks through three theaters where the new target class is already playing out. In the Middle East, Iran's February attacks are evidence of an active playbook. Striking regional AWS and Oracle sites punished both the US companies that own the hardware and the regional banks, payment platforms, and governments that depend on it. Iran then made the targeting intent explicit by listing eighteen major tech firms as military objectives, raising the cost of any future US or Israeli strike on Iranian leadership.

In Europe, the authors expect Russia to extend the gray-zone pressure it has applied to undersea cables and European energy infrastructure to data centers in Nordic and Baltic states. Cool climates, cheap power, and proximity to the continent make these sites attractive, but the same logic that draws them in also makes them reachable. The paper warns that in a real NATO-Russia crisis, AI data centers in northern Norway or Finland could be struck, seized, or held hostage, and the alliance has not yet built the doctrine for that fight.

The most consequential case is the Indo-Pacific. AI data centers in southern Taiwan, away from the Taipei concentration that most invasion scenarios focus on, are coming online fast. The MWI authors argue that gives Beijing an alternative point of pressure in any Taiwan contingency. Seizing and operating a southern AI campus would let China preserve advanced AI infrastructure for its own use, the same way it has historically captured chip fabs and port equipment. The authors also flag Johor, Malaysia, where US, Chinese, and Singaporean firms are racing to build capacity next to one of the densest undersea cable hubs in the world. In a broader regional conflict, Beijing could use diplomatic or kinetic tools to deny US firms access to that infrastructure, or to cut the data flows between Johor and Singapore that US forces rely on for logistics.

Three shifts defenders and operators should make now

The MWI paper is not a doom piece. It is a call for militaries and operators to update their mental models. Three shifts stand out.

First, treat data centers as defended territory. That means hardening against kinetic attack, not just ransomware, and it means redundant power and fiber paths, hardened cooling, and dispersed backup sites that can pick up training or inference load when a primary campus is offline. Most enterprise buyers of AI capacity, including the cloud customers who use a vendor's training clusters as a black box, will need to start asking their providers questions about physical resilience, not just uptime SLAs and SOC 2 reports. For a closer look at how hyperscale AI capacity is being built and contracted today, our AI infrastructure reference page walks through the chip, cloud, and capacity choices that define the current build-out.

Second, rethink concentration. The economics of AI training push toward a small number of huge campuses. The MWI analysis suggests the strategic case for pushing back is now as strong as the cost case. A federation of mid-sized AI campuses, each drawing a few hundred megawatts, scattered across multiple power grids and jurisdictions, may end up cheaper in expected loss than a single nine-gigawatt site in a friendly but reachable state. This is the same logic that already pushes the US military to spread its own compute across multiple installations, and it now applies to the commercial sector.

Third, prepare for gray-zone pressure. Iran did not need to destroy every AWS data center in the Middle East to send a signal. Striking three was enough. The next attacker may not even need kinetic action. Coordinated cyberattacks on power utilities, social engineering against substation operators, or sustained physical surveillance of fiber routes are all options that fall below the threshold of a clear act of war, and the MWI authors argue the same playbook will be used against AI infrastructure in any future conflict.

The Iran strikes, the Russian gray-zone pattern in Europe, and the southern Taiwan build-out are not separate stories. They are early chapters of the same one. The countries and companies racing to build the biggest AI campuses are also the ones most exposed to a new class of attack, and the planning cycle for defending that infrastructure is still years behind the construction cycle. That gap is the most important infrastructure story in AI right now, and it is unfolding far from the data center loading docks most readers picture.