Iranian strikes damaged Amazon Web Services data centers in the United Arab Emirates and Bahrain in March, disrupting critical cloud infrastructure and exposing a dangerous weakness in America's defense posture. In April, Iran's Islamic Revolutionary Guard Corps publicly claimed responsibility for targeting an Amazon cloud-computing facility in Bahrain—not as collateral damage in a broader conflict, but as a deliberate strike against American commercial computing assets.
The attack exposes a strategic blind spot in how the U.S. government views national security. For decades, defense doctrine relied on geography: borders, military installations, and troops stationed abroad. That calculus has shifted. Data centers, cloud-computing systems, telecommunications networks, and digital infrastructure now matter to national survival as much as traditional military assets, yet they're often thousands of miles from American territory and privately owned with little government oversight.
The numbers tell the story. Military operations depend on commercial cloud technology. Financial institutions process trillions of dollars through connected digital systems. Hospitals, power grids, logistics networks, and energy providers rely on computing infrastructure that a determined adversary could knock offline. Artificial intelligence—increasingly central to economic competitiveness and military capability—requires enormous computing capacity concentrated in a handful of facilities worldwide.
The Vulnerability Gap
Federal law broadly defines critical infrastructure as systems whose destruction could devastate national security, economic security, or public safety. Yet the government hasn't clearly designated which private digital infrastructure meets that threshold or merits protection. A data center supporting military logistics or advanced AI could matter as much to national security as a traditional defense facility. An adversary can also attack it from thousands of miles away using asymmetric tools—cyber operations, infrastructure attacks, or direct strikes—that don't require conventional military force.
Russia has shown a willingness to weaponize cyber operations and infrastructure attacks. China has invested heavily in cyber capabilities and studied the vulnerabilities created by American reliance on interconnected systems. Iran, as recent events confirm, shows no hesitation in targeting U.S. commercial computing infrastructure directly. An adversary doesn't need to cross a border or launch missiles at military installations. It can disrupt a power grid, compromise a communications network, attack computing infrastructure supporting critical services, or target the supply chain feeding strategically vital facilities.
A Framework for Protection
Congress should establish a narrow designation for exceptionally important American-owned or American-controlled digital infrastructure, with rigorous standards for ownership, control, cybersecurity, physical security, supply-chain integrity, and cooperation with national-security agencies. The designation wouldn't make overseas facilities American territory—a data center in Bahrain would remain in Bahrain—but it would set clear consequences for deliberately attacking strategically vital infrastructure.
Potential responses could include sanctions, asset freezes, diplomatic measures, and defensive cyber operations. Depending on circumstances and attribution, Congress could authorize additional measures. The goal isn't automatic escalation to military conflict; it's to make consequences clear enough to deter attacks.
President Trump's June 2026 National Security Presidential Memorandum on artificial intelligence directed the national-security enterprise to accelerate AI adoption and strengthen partnerships with private industry. That recognition matters—but it remains incomplete without a framework to protect the infrastructure supporting AI development and deployment. Companies operating designated facilities should meet high standards for cybersecurity, physical security, redundancy, and resilience. The administration should work with allies on reciprocal protections for strategically important infrastructure overseas.
The Iranian attacks in March and April weren't aberrations. They're a preview of how future conflicts could begin: not with troops crossing borders, but with lost computing capacity, disrupted communications networks, or failed systems on which millions depend.
Why This Matters:
The U.S. government has no clear policy framework for defending private digital infrastructure vital to national security. This gap creates immediate risks and institutional confusion. Iran's willingness to target American cloud infrastructure suggests adversaries recognize the weakness. Without designated protection standards, companies have little incentive to invest heavily in redundancy or resilience. The government can't coordinate defense, and the private sector operates without clarity about what national security actually requires. A narrow designation system wouldn't eliminate private enterprise or expand government control—it would identify which facilities warrant protection and which standards matter. That's pragmatic governance: recognizing where market incentives alone don't align with national security, setting minimal standards, and letting companies operate within them. The alternative is waiting for the next attack to expose another gap.