Before dawn on March 1, Iranian Shahed drones struck two Amazon Web Services data centres in the United Arab Emirates. A third AWS facility in Bahrain was damaged. The attacks forced the facilities offline, disrupting banking, payments, delivery apps and enterprise software across the region. A month later, on April 1, another drone hit the Bahrain site. Iran’s Islamic Revolutionary Guard Corps claimed responsibility, saying the centres were targeted for their role supporting US military operations. It was the first time that a state had deliberately targeted commercial data centres during wartime, but probably not the last.
On the same day as the second Bahrain strike, Iran’s state media issued threats against a host of American technology companies, including Google, Microsoft, Apple, Nvidia, Oracle, Intel, IBM, Cisco, Dell, Palantir and Meta. The tech industry often talks about ‘the cloud’ as though it were something abstract and untouchable, but it in fact runs on data centres, and those data centres have addresses which can be hit by drones.
Which means, were it not previously clear, that the boundary between commercial cloud computing and military operations has largely vanished. The Pentagon’s Joint Warfighting Cloud Capability runs on the same infrastructure that serves banks and ride-hailing apps. The US military uses AWS to run AI models for intelligence analysis. So when Iran threatened ‘economic centres’ linked to American entities, it was not making idle chatter. Data centres are now military targets.
A growing market
The attacks have focused minds in a market that was already booming. The global counter-drone industry is projected to reach 16.45 billion US dollars by 2034, and Europe has been particularly keen. According to Dealroom and the NATO Innovation Fund, European defence, security and resilience start-ups raised 8.7 billion US dollars last year, up 55 per cent year on year. NATO allies increased defence spending by 20 per cent. Much of that is going into anti-drone systems. Autonomous systems and counter-unmanned aerial systems are among the most heavily funded categories.
The technology stack is layered. Radar provides wide-area airspace surveillance, while radio-frequency sensors scan the electromagnetic spectrum for drone-to-operator control links. Electro-optical and infrared cameras provide visual confirmation, and acoustic sensors detect the distinctive rotor signatures. AI-powered command-and-control software fuses all sensor inputs in real time. Mitigation options range from radio-frequency jamming to kinetic interceptors to high-powered microwave weapons.
The most analytically interesting subsegment, according to Research and Markets, is the autonomous and AI-enhanced kinetic defeat layer, sized at 600 million US dollars in 2025 and projected to reach between 1.4 billion and 4.1 billion US dollars by 2030.
What cloud operators can do
The AWS incidents have left cloud operators scrambling. Standard commercial property and business interruption insurance policies frequently exclude acts of war, which means companies must secure specialised war risk policies. These are complex and heavily contested by underwriters. Legal analysts reckon that if a cloud facility is disabled by a strike, regional courts are likely to view the event as a foreseeable risk of operating in a conflict zone. Without bespoke military-disruption clauses that shift financial risk onto the client, tech providers will be legally required to absorb costs and refund clients entirely.
Geographic redundancy is the first line of defence. Many companies had no meaningful Middle East presence but their cloud workloads were routed through the region, invisible to them until the outages hit. AWS has advised customers to back up data, migrate workloads to other regions and direct traffic away from Bahrain and the UAE. The forced shift will drive up cloud revenues as companies abandon single-region deployments (Amazon’s stock rallied three per cent following the attack).
Physical hardening comes next. Data centre operators are deploying counter-drone systems that can detect, identify and neutralise intruding drones. Companies like DroneShield offer multi-sensor packages that detect incoming threats and alert operators in real time. Some systems can track the drone pilot’s location for prosecution. Operators set up exclusion zones around facilities, allowing automated disruption without direct human input.
A few operators are fighting drones with drones. Novva Data Centers has deployed autonomous security drones from Nightingale Security at its Utah campus. The machines perform regular perimeter checks using 4K cameras, LiDAR and infrared sensors. Compass Datacenters is piloting similar systems. The drones run pre-defined missions, respond to alerts automatically, and return to weatherised base stations for recharging. They process video feeds through machine-learning algorithms on site, detecting cars, people or unauthorised aircraft.
Site selection matters more than it used to. Facilities near conflict zones are riskier propositions. So are those near NATO’s eastern flank, where drone incursions from neighbouring countries have disrupted airports and operations. Last year a drone in Poland disrupted airports and Ryanair operations. In early April, Lithuanian authorities held exercises at Achema, the largest fertiliser producer in the Baltic states, simulating a drone attack on the premises and the response to a fire and major chemical accident.
An emerging hub
Central and Eastern Europe is positioning itself as a dual-use defence hub. According to Daiva Rakauskaitė, manager at fund management company Aneli Capital, CEE countries have lots of hidden talent and sit next to Ukraine, which gives them the ability to test technologies in the real world. The Dealroom-NATO Innovation Fund report shows Central and Eastern Europe had the fastest growth in deal velocity for defence start-ups.
Poland’s 4.2 billion US dollars SAN CUAS programme, awarded to a consortium of Kongsberg Defence & Aerospace and Polska Grupa Zbrojeniowa, will deliver 18 counter-UAS batteries. Lithuania, Latvia and Estonia are all investing in protection for critical infrastructure, including ports, energy facilities and data connections. The war in Ukraine has shown what cheap drones can do against expensive targets. A documented asymmetry from Operation Spider’s Web showed 117,000 US dollars in consumer drones destroyed three billion US dollars in Russian assets, a 25,000-fold cost advantage.
The lesson is clear, and governments have woken up to the threat. Businesses operating critical infrastructure need to do the same. As Rakauskaitė puts it, the war in Iran should act as a wake-up call for companies not just in the Middle East. Drones are cheap, sophisticated and everywhere. Cloud operators can no longer afford to think of their facilities as civilian infrastructure exempt from military logic. The sky is no longer a safe space.
Photo: Dreamstime.
