Power Lines, Part 1: The Cloud on the Ground

Welcome back, and thanks for being here.

This issue starts Power Lines, a three-part series on the energy infrastructure that sits underneath technology and global security.

The idea is simple. Software feels weightless, but it runs on buildings, cables, power plants, and fuel. Each of those can be bought, blocked, or bombed.

Part 1 starts where the digital world meets the physical one: the data center.

"The cloud" is a friendly name for a building. A large data center is rows of servers, plus the substations, chillers, and backup generators that keep them running around the clock.

Those buildings use a lot of power. The International Energy Agency estimates that data centers consumed about 415 TWh in 2024, and projects around 945 TWh by 2030, driven largely by AI. The U.S. and China account for nearly 80% of the projected growth.

The demand also clusters. In Ireland, data centers used 23% of metered electricity in 2025, up from 5% in 2015. That's more than all of Ireland's urban homes combined.

In Northern Virginia, the world's largest cluster, the main utility's contracted data center capacity nearly doubled in six months, to about 40 GW, in 2024.

What powers them matters too. The IEA estimates renewables supply about 27% of data center electricity today, natural gas 26%, and nuclear 15%. So the security of computing depends on the security of those fuels, a thread this series returns to in Part 3.

Data centers go where power is cheap, land is available, and fiber connects. That's why the Gulf states, with cheap energy and deep pockets, have been competing to become global AI hubs.

Computing has become one of the largest new loads on the world's power systems, and it's concentrated in a handful of places.

On March 1, 2026, a day after the U.S. and Israel began striking Iran, Iranian drones directly hit two Amazon Web Services (AWS) data centers in the United Arab Emirates. Another strike, close by, damaged a third in Bahrain.

Amazon reported structural damage, cut power, and water damage from fire suppression systems. About 60 services across the region were disrupted. Banks, payment firms, and a ride-hailing app went down with them.

Iran's Fars News Agency said the strikes were deliberate, aimed at the centers' role "in supporting the enemy's military and intelligence activities." The Uptime Institute called it the first confirmed military attack on a hyperscale cloud provider.

The damage lasted. By September 2026, AWS said data held only in its Bahrain region and one UAE zone couldn't be recovered. Amazon reportedly issued about $150 million in credits, and its insurance excluded war.

The threat then widened. Iran's Revolutionary Guard named 19 companies, including Microsoft, Nvidia, and Palantir, as "legitimate targets." The UAE began redesigning its planned $30 billion Stargate AI campus, which sits near Al Dhafra Air Base, home to U.S. troops. The plan now under review would spread it across several sites, harden it against blasts, protect it with interceptors and jammers, and possibly put parts of it underground.

Once a data center can be targeted like a military installation, it has to be planned like one.

Cloud providers split each region into availability zones: separate data centers with their own power and cooling. They're far enough apart that a flood or fire is unlikely to hit two at once, but within about 100 km (60 miles) of each other so data can move quickly between them.

That design assumes failures are independent. A drone campaign isn't. In the UAE, two of three zones went down together.

"Multi-AZ is NOT disaster recovery," one bank engineer wrote afterward. "It protects you from hardware failures."

Physical security was built for threats on the ground, too: fences, cameras, and guards. The equipment that keeps servers alive often sits outside the main hall. "If you knock out some of the chillers you can take them fully offline," Sam Winter-Levy of the Carnegie Endowment told Fortune.

Law can deepen the problem. Many countries require sensitive data to be stored inside their borders. That keeps government and banking data in a small number of local facilities, and can make it harder to move abroad in a crisis.

Cloud resilience assumes failures happen one at a time. War doesn't work that way.

Militaries now run a growing share of their planning and analysis on commercial cloud. The Pentagon's $9 billion cloud contract is split between Amazon, Microsoft, Google, and Oracle, the same companies that serve banks and delivery apps.

Whether the Gulf buildings held military work hasn't been confirmed. For an attacker, it may not matter. From the outside, any hyperscale facility could be carrying military traffic.

The logic is old. In May 1898, during the Spanish-American War, U.S. sailors cut undersea telegraph cables off Cuba. Some belonged to British companies.

In 1923, an arbitration tribunal ruled the U.S. owed those companies nothing. Cutting enemy communications was a legitimate act of war, it found, and the companies had accepted the risk of operating under Spanish concessions.

"The cloud has become the modern telegraph cable," lawyer Mahmoud Abuwasel wrote after the Gulf strikes.

Infrastructure that serves a military, even partly, has always risked being treated as part of one.

Three things stand out.

First, computing is now strategic infrastructure, but it's privately owned and sited for commercial reasons. Data centers follow power prices, land, and tax incentives, not threat maps.

Second, nobody clearly owns its defense. A cloud company can't shoot down drones. Insurers exclude war. Host governments have whole countries to protect, and military customers buy services, not protection for the buildings they run in.

Third, the building is only the visible layer. A data center is only as secure as the power and cooling behind it. Hit a substation, and the servers don't need to be touched.

There's a lot we don't know, including whether the struck buildings held any military workloads. It's also fair to note that most AWS customers moved their work successfully, and that the Gulf's draws (cheap energy, capital, and location) haven't gone away.

Software feels weightless.

It runs on buildings, and buildings have addresses.

Next in Power Lines, Part 2: The Grid Is a Front Line.

If you found this week's issue useful, it would mean a lot if you'd share or comment!

Not yet subscribed? Here's your chance…

Thanks again, and see you next week!