Instead of targeting data centers, it's far easier to target the electrical substation that powers the datacenter. It's relatively simple to do. Transformers require oil to cool themselves, and if the coolant reservoir is damaged, then they overheat and shut off. This exact infrastructure attack occurred in North Carolina in 2022 [0], where someone fired bullets into the coolant reservoirs and caused a several day power outage. The perpetrator was never caught. It's speculated a foreign actor did this to gauge the response in a future wartime scenario.

[0] https://en.wikipedia.org/wiki/Moore_County_substation_attack

I recently wrote a little on this https://generalresearch.com/detail-oriented/how-to-seed-a-cl...

While we're completely at the mercy of datacenters that we can colo out racks / power / upstreams from, it's a worthy discussion for any technology company that wants some amount of digital sovereignty over their presence online and ability to provide their service independent of a hypervisor / cloud provider (or even just a centralized location).

The best option is simply to anycast from any many distinct countries that are either neutral, or unlikely to be involved with any global or regional conflicts at any given time. You don't want them getting bombed at the same time!

In any significant war the Internet is going to go down. That's what has happened empirically in countries undergoing significant wars or social unrest, like Russia, Iran, Yemen, Ethiopia, Syria, Myanmar, and Afghanistan. While IP packet routing itself may have been designed to survive a nuclear war, there have been many centralized systems built on top of it (DNS? Edge caching? Cloudflare? Big Tech) that are essential to the functioning of what we know of as the Internet.

If your threat model includes war and you want to have some of the conveniences of the Internet, you should make plans for how to host local copies of data and develop local-scale communications for the people you regularly talk with. The Internet is too big of a security and propaganda risk for governments to allow it to continue to exist when they are engaged in a real existential war.

Ironically,the classical target, Washington DC, is less than 25 miles down a very simple highway to Northern Virginia's massive datacenter alley. Our national defense is ultimately predicated on heavy ordnance not being able to show up undetected in this part of the world. Hence the path preferred by attackers of burrowing into Azure signing keys or ransomware attacks on the grid. Much less hardware to transport.

The way everything is so overleveraged on the success of these companies being packed into ETFs, it would probably take down the whole economy. You'd be able to shut down even more manufacturing without even destroying it just from economic forces. That is unless the US responds by nationalizing everything, which they won't. They'd rather it go to smithereens so someone has a chance to be made wildly rich rebuilding.

There are ways to shield data centers if one is serious about it...

e.g.

https://www.reuters.com/world/middle-east/oracle-opens-first...

Agreed that Govt/Military runs on AWS/Azure/whatever. They care about "security" in a "virtual" sense, but I presume soon we'll see requirements like: "Must Have: Missile Defence Perimeter" next to the "Must be FIPS compliant".

Don't forget underseas cables: https://www.submarinecablemap.com/

> the first time I've really thought hard about how big a target data centers would be in any sort of modern peer war

Given the rapid and increasing rise of AI use in actually fighting wars, I suspect data centers won't just be a big target, they will eventually be the #1 priority target. Taking them offline won't just be of interest in terms of economic damage, it will be a direct strategic goal toward militarily winning the conflict.

>We've built trillions and trillions of dollars in infrastructure in the peace time since, and it seems fairly concentrated.

and thus is easily defended. It would be a pocket change - tens of millions - for AMZN to put say a Rheinmetall Skyshield https://en.wikipedia.org/wiki/Skyshield at the data center.

It's not quite as bad as in the UAE where only about 10% of the nation has citizenship but it's basically the same picture. Most people there are practically indentured servants

>if you dont colo your own servers you don't own anything.

I'm confused, what does ownership have to do with this particular failure mode? The issue here is a (for many) unforeseen new tradeoff involved in centralization. Colocating at a central place has the exact same tradeoff in this case: bandwidth is vastly more available and cheaper towards the core, and there are significant amortization gains to be had with a lot of basic shared infra. But it's also one big structure holding a lot of computers and infra everyone is depending on, that's the whole point of it! We're all sharing network backbone and power filtering/redundancy and so on and so forth, vs paying for that separately. That means a missile or drone or bomb hit to the building still hits all of us whether we own the servers there or we're running workloads on someone else's servers.

The only responses are either central counter measures or decentralization. Both have significant costs and complexity, that's why it wasn't just done proactively right?

You should have the opposite takeaway - if you don't have redundancy in the cloud you don't actually have uptime.

I don't think co-locating with AWS or any other DC in Middle-East would help in this case. Unless you bring your own missile defence network, you are vulnerable.

In the case of if you could bring your own missile-defence-network, then you probably don't need co-location anyway. (There is nothing "co", it's just location you build & operate, with your Patriot or whatever)

Your servers also may get hit with a bomb/missle.

Why would I want to own a cut-off datacenter in Dubai?