Gult data centres have been targeted by Iran in a new development in the war [Getty]
Investment in data centres and cloud computing across the Gulf are now under threat, after Iran’s Islamic Revolutionary Guard Corps (IRGC) announced on 21 July that it had targeted infrastructure belonging to Amazon Web Services (AWS) in Bahrain.
Commercial digital infrastructure is now part of a regional military confrontation and questions are being raised about the future of investments on which Gulf states are relying to lead artificial intelligence.
The IRGC said the strike targeted infrastructure hosting the “me-south-1” cloud region operated by Amazon Web Services, which the company launched in 2019 as its first cloud region in the Middle East.
It claimed that the facility was the US Central Command’s (CENTCOM) “digital eye”, arguing that it plays a role in supporting US military operations in the region.
Iran had previously designated 18 US technology companies as what it described as “legitimate military targets”, according to a report published by technology and data centre platform Tom’s Hardware.
The developments come as Gulf states compete to attract global technology companies and invest billions of dollars in data centres and cloud services as part of plans to transform the region into a regional hub for artificial intelligence and the digital economy.
However, the inclusion of these facilities among potential targets adds a new factor to investor calculations, as security and geopolitical risks become part of investment viability assessments alongside operating costs, energy availability and infrastructure.
Several specialists, including military expert Sean Gorman, have previously warned that targeting data centres could have consequences extending beyond disrupting servers or damaging equipment, affecting entire economic sectors that rely on cloud services, including banks, e-commerce platforms and digital government services.
This could increase investment costs and place greater pressure on operating companies, according to an assessment published by the security and military affairs platform Small Wars Journal on 9 April.
The region therefore appears to be entering a new phase of open confrontation in which cyber warfare merges with direct military strikes targeting digital infrastructure used by the United States and its allies.
This includes the Joint Warfighting Cloud Capability (JWCC) project, valued at $9 billion and operated by major technology companies, including Amazon.
Against these challenges, the new geopolitical reality requires Gulf states to reconsider their digital transformation plans and accelerate the development of sovereign, protected cloud systems to reduce dependence on servers and networks owned by international entities that could become targets in any military escalation.
Gulf governments and local companies are also moving towards adopting resilient recovery strategies based on distributing data across multiple domestic and international centres in secure locations to ensure service continuity and protect operational data, according to an assessment published by technology investment and data centre risk analysis platform Enkiai on 22 July.
Iranian deterrence doctrine
Iranian affairs specialist Shaimaa Al-Mursi told The New Arab that the shift from targeting energy networks, bridges and ports to targeting digital clouds and data centres represents a profound structural transformation in Iran’s deterrence doctrine.
Tehran, she said, recognises that the Gulf economy and US military operations no longer depend solely on oil and conventional facilities, as data and cloud servers have become the main lifeline of this system.
Al-Mursi believes the Iranian escalation in Bahrain marks the beginning of a new phase that can be described as the “cloud paralysis balance”.
The US military and Central Command, she said, rely almost entirely on cloud services provided by major technology companies such as Amazon, Microsoft and Google to operate artificial intelligence applications, analyse surveillance data and manage command-and-control systems.
That, she said, makes the targeting of an Amazon data centre in Bahrain a direct attempt to strike the digital infrastructure supporting these operations.
According to Al-Mursi, the Iranian attack represents a methodological shift from software-based cyberattacks, such as denial-of-service attacks or ransomware, to targeting the physical infrastructure of servers and cooling systems.
Such attacks could result in sudden and widespread disruption of digital services that is difficult to address remotely.
She added that Tehran seeks to shift the cost of war to major US technology companies in Silicon Valley in an effort to pressure them into lobbying Washington to keep their Gulf assets separate from military coordination.
This shift is reflected in Gulf digital investments, according to Al-Mursi, who expects data centres to face record increases in war risk insurance premiums.
Technology companies, she said, may also be forced to invest heavily in complex defensive infrastructure and establish alternative emergency centres, reducing profit margins and limiting the appeal of the regional market.
Because of the Gulf’s growing reliance on cloud computing in governance, financial services and shipping, any disruption to a local data centre could trigger a chain of technical and operational failures extending into sensitive civilian and economic sectors unrelated to the conflict.
Despite this, Al-Mursi does not expect the development to result in a complete withdrawal of global companies.
However, she believes it will force a profound geographical and strategic restructuring of investments, with investors becoming more cautious and reducing concentration in coastal centres close to Iran, such as Bahrain.
She also expects investors to favour data centres further inland or link them to backup centres in Jordan and western Saudi Arabia.
Al-Mursi also does not rule out the possibility that regional states will require the establishment of independent, closed civilian cloud systems that completely separate government and economic data from US military networks.
The aim, she said, would be to avoid these centres being classified as legitimate targets under Iran’s deterrence doctrine.
She believes this places artificial intelligence projects and the transition towards a knowledge economy before major challenges related to delays in hosting plans and training models locally.
For financial technology and e-commerce start-ups, Al-Mursi expects companies to face greater difficulty convincing investors to rely entirely on cloud infrastructure located in a region experiencing armed conflict.
Some government and financial institutions may temporarily strengthen their reliance on local servers, considering them politically safer, which could slow the transfer of sensitive assets to international cloud platforms.
Al-Mursi concluded that targeting an Amazon data centre signals that cloud infrastructure has entered the list of assets that can become military targets in Middle East conflicts.
Although the Gulf’s financial resources and the importance of digital transformation projects will prevent this process from stopping, the cost of achieving digital stability will rise significantly.
This, she said, will force governments and global companies to redesign their security models around a clear separation between civilian and military clouds while distributing risks geographically.
Fundamental shift in the nature of conflict
Pascal Daher, an academic specialising in judicial oversight of banks, told The New Arab that the Iranian targeting of Amazon data centres represents a fundamental shift like conflict.
Digital infrastructure, he said, is now treated as part of strategic dual-use assets.
He added that military attention has shifted from oil facilities, ports and conventional airports to data centres, cloud computing networks, submarine cables and satellites.
These have all become an essential part of the equation of deterrence and counter-deterrence, reflecting a transition from energy warfare to digital infrastructure warfare.
He believes this sends a clear message to investors that the cost of investing in digital infrastructure within geopolitically tense regions has increased significantly.
According to Daher, the development carries four main economic consequences.
The first is higher investment costs for data centres due to rising insurance premiums, cybersecurity expenses, physical protection costs and business continuity requirements.
The second is that global technology companies are likely to reassess the distribution of their digital assets and avoid relying on a single centre in a high-risk region.
The third is an increase in financing costs for digital projects as investors demand higher returns reflecting elevated security risks.
The fourth is accelerated investment in backup data centres in more stable countries to ensure service continuity.
Regarding major corporate investments in the Gulf, Daher does not expect a mass withdrawal because these companies rely on long-term strategies and are tied to the region’s large-scale digital transformation programmes.
However, he expects investment restructuring and a more cautious geographic distribution of data, which could lead to short-term effects such as higher implementation costs or delays in some new investments.
Nevertheless, Daher said Gulf states possess the resources needed to absorb the shock.
These include strong financial capacity, the ability to finance digital infrastructure, strategic partnerships with global technology companies and increasing government interest in the digital economy as one of the pillars of the post-oil era.
For that reason, digital transformation projects are unlikely to stop, although they will become more expensive, with greater emphasis on cybersecurity and digital sovereignty.
Daher concluded by stressing that the Iranian targeting of Amazon centres is linked to financial stability as much as technological security because banks increasingly depend on cloud computing and data centres.
This, he said, will push regulators to tighten operational resilience tests and strengthen financial institutions’ readiness to continue providing vital services during cyberattacks or data centre outages, while ensuring rapid recovery and minimising the impact on customers and markets.
Daher concluded that the region is witnessing an expansion in the concept of strategic assets to include data centres as an integral part of the geopolitical deterrence equation.
If this pattern continues, international competition will extend from control over energy and maritime routes to control over data and cloud computing.
That, he said, will create a dual challenge for Gulf states: continuing digital investment while simultaneously strengthening protection, shifting the priority from rapid expansion to building a more resilient digital system capable of withstanding geopolitical risks.
Article translated from Arabic by Afrah Almatwari. To read the original, click here.
