Iranian Attacks on the Amazon Data Centers: A Legal Analysis

In an unprecedented series of attacks, Iran has targeted commercial data centers in Gulf countries in the context of the armed conflict initiated by the United States and Israel on Feb. 28. On March 1, it used Shahed 136 drones to strike two Amazon data centers in the United Arab Emirates (UAE), causing devastating fire, power outages, and further damage as firefighters fought the blazes. A strike on a third Amazon data center in Bahrain soon followed, although reports suggest the attack caused the damage indirectly when a drone hit nearby. It is unclear at this time whether the strike slightly missed the data center or merely caused collateral damage to the facility while attacking another target. 

These attacks highlight the importance of data centers to civilian society and their growing operational significance in contemporary warfare. The increasing reliance on cloud computing and artificial intelligence (AI) also raises a number of intricate issues that have been at the heart of controversy over the application of rules governing the “conduct of hostilities,” which form part of the body of international law known as the law of armed conflict (LOAC). Do data centers qualify as lawful military objectives? If so, under what circumstances are they subject to attack? And what precautions must be taken before attacking those used for civilian purposes as well? We tackle these and related LOAC issues in this article.

In this regard, it is essential to note that the data center attacks occurred during an international armed conflict between Iran and both States – the UAE and Bahrain. Such conflicts are triggered when one State engages in hostilities with another (DoD Law of War Manual, § 3.3.1; Tadić, Jurisdiction, ¶ 70). On Feb. 28, following U.S. and Israeli attacks across Iran, Tehran launched hundreds of drones and missiles at targets in neighboring States, including the UAE and Bahrain. Some of Iran’s targets were U.S. military facilities, which might have raised questions regarding the exercise of belligerent rights in neutral territory against an enemy located there. Others were not, including the data centers attacked in the UAE and Bahrain, which means Iran’s bombardment of those countries undeniably initiated an international armed conflict between Iran and those two States. Accordingly, there is no question that the law of armed conflict governed the operations against the data centers.

Read more at Just Security