Ukraine’s Attacks on Russian Data Centers Lay Bare a Global Risk to AI

Connor Martin is an expert on the national security implications of cross-border capital flows and on the national security risks posed by frontier technologies such as artificial intelligence (AI).

Last week, Ukrainian drones took out three data centers owned by Yandex, the internet conglomerate sometimes referred to as Russia’s Google, in retaliation for Russian strikes on its own data centers. Because Yandex is thoroughly integrated into Russian life as a provider of cloud services, the strikes caused severe disruptions across the country, impeding Russians’ ability to send emails, make payments, and navigate the streets. Ukrainian President Volodymyr Zelenskyy even suggested that they led to a decline in bot activity on social media platforms (a claim that was soon disputed).

These strikes will have minimal effect on the global race to develop and adopt artificial intelligence. Russia is nowhere close to the cutting edge of the field—lagging as much as three to five years behind the United States and China, according to a Kremlin-aligned university. It is hamstrung by lack of access to cutting-edge chips and by a brain drain of engineers, both issues that emerged following its invasion of Ukraine in early 2022.

Even so, Ukraine’s drone strikes will likely still set back Russian AI efforts further, because Yandex’s three supercomputers (located in the data centers that were struck) run on Nvidia A100s—U.S.-designed chips that Russia will be unable to easily replace. And the strikes have continued: earlier this week, Ukraine hit another data center that was under construction, this one belonging to Sberbank, Russia’s largest bank.

But the bigger implication of the Ukrainian strikes is that they have laid bare a fundamental risk to the development and deployment of AI worldwide: its physical infrastructure is vulnerable.

The term data centers can describe facilities that host everyday cloud services or facilities that are purpose-built for training and deploying AI. Some facilities, such as two of the Yandex sites, do both. Whatever their purpose, data centers share certain key features: they are big and immobile, and therefore hard to defend; they are also expensive and labor-intensive to construct, and therefore hard to replace. As AI capabilities increasingly underpin both the health of global markets and countries’ ability to project strength, data centers are proving to be an especially vulnerable node in the technology’s system of delivery, collectively known in the cybersecurity field as its “attack surface.”

This was already apparent in March of this year, in the early days of the Iran war, when Iranian drones struck two Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and damaged another in Bahrain. As AWS described in an alert to customers, the strikes caused physical damage to the data centers themselves, disrupted power delivery, and triggered fire suppression that caused additional water damage. In September, AWS concluded that it was “unable to restore access to the resources and data” that had been hosted exclusively at two of these facilities, but noted that “most customers have been able to re-establish their operations in other regions by restoring backups or copying data that remained accessible.”

Even though AWS has committed to replacing damaged equipment, companies that rely on its servers may legitimately press for assurances that these disruptions will not recur—assurances that neither AWS nor Microsoft, Oracle, or Google (each of which also operates data center clusters in the region) can reasonably provide. As recently as this week, Iran’s security chief warned that, if the fighting resumed, data centers and the subsea cables connected to them would be targets. As others have pointed out, even when the Iran war ends, the Middle East will continue to be a risky place to site these assets long into the future, a reality reflected in the rising cost of insuring these assets.

Whether they are located in Russia, Ukraine, the Gulf or elsewhere, three characteristics of data centers make them an especially vulnerable node in the AI attack surface: (1) their size, (2) their fixed locations, and (3) the integrated nature of their systems.

Data centers have historically averaged approximately 100,000 square feet, and the hyperscale data centers used to train and deploy frontier AI can be significantly larger. The Stargate UAE campus, which Iran has explicitly threatened, was initially conceived of as a ten-square-mile campus (although this project is now reportedly under review).

The challenge of defending such large targets is compounded by their fixed nature. Most data centers sit above ground and are hard to conceal. They cannot pick up and move when threatened, like the B-1 bombers that the United States relocated from the United Kingdom earlier this month. Additionally, not every location is equally viable. Data centers depend on access both to robust local power supply and to the global network of fiber-optic cables, and the right location can shave milliseconds off the time it takes for data to travel from point A to B, an interval known as latency.

Finally, the facilities are not just the server racks themselves, but an integrated network of sensitive systems, including power transmission and cooling infrastructure to keep the chips from overheating. An attack that hits any one of these systems could render the whole inoperable.

The options for hardening data center defenses are limited. Current industry standards for physical security are primarily designed to prevent unauthorized intrusion—a nontrivial concern, as this week’s arrest of a Saudi employee of OpenAI demonstrates how one person with the right physical access privileges can potentially compromise highly sensitive information. They do not address risks from the air such as missiles and drones, whether from acts of war or from terrorism. Given the vulnerability inherent in their features and the value concentrated in them, data centers will always be attractive targets in a kinetic conflict.

Companies and nations seeking to protect their data centers should therefore pursue a strategy of redundancy and resiliency. One important feature of such a strategy is data portability.

Russia’s strict data localization law leaves it few options to supplement the damaged Yandex facilities; in contrast, Ukrainian providers weathered strikes on their own data centers by backing up to other servers in the European Union (EU). As governments consider data localization requirements, such as the EU’s proposed Cloud and AI Development Act, the cost to resiliency in a crisis should be weighed against perceived benefits. Another way to bolster resiliency is to invest in edge computing, which disperses data processing across many smaller sites closer to the point of service (although edge computing cannot replace AI training or supercomputers, whose performance depends on their scale). Finally, some companies are investing in alternative models for building data centers underground or in space. But while data centers in space could solve some vulnerabilities, they could also create new ones, and in any case they are years away from being commercially or technically viable.

At its highest levels of performance, AI’s capabilities can appear otherworldly—but it is fundamentally a technology dependent on physical things. Defending it is just a new version of the oldest problem in warfare: how to hit your enemy’s infrastructure while stopping them from hitting yours. As long as they provide value, data centers will be targets. Countries and companies are well advised to prepare for that future now.