American national security strategy is falling behind the technological transformation of the economy and military, according to a new analysis that calls on Congress to create a formal designation for exceptionally important digital infrastructure. The argument follows a series of Iranian strikes in the Middle East that damaged commercial computing facilities and disrupted cloud services, exposing the vulnerability of assets that are privately owned and often located far from US territory.
In March, Iranian strikes damaged Amazon Web Services data centers and related infrastructure in the United Arab Emirates and Bahrain, disrupting cloud operations and creating problems with power and connectivity. The damage contributed to service disruptions and an extended recovery process. Then, in April, Iran's Islamic Revolutionary Guard Corps publicly claimed that it had targeted an Amazon cloud-computing facility in Bahrain. That public claim matters because it shows the facility was not simply a commercial site caught in the crossfire. Iran identified American commercial computing infrastructure as a target.
The episode should serve as a warning for Washington. American power increasingly depends on infrastructure that is privately operated and, in some cases, located outside US borders. The military relies on commercial technology and cloud computing. Financial institutions depend on digital infrastructure to process transactions and maintain operations. Hospitals, communications networks, logistics companies and energy providers all depend on interconnected systems. Artificial intelligence, which is becoming important to both the American economy and national defense, requires enormous amounts of computing capacity and data. The building may be privately owned, but the consequences of destroying it may extend far beyond the company that operates it.
Federal law already defines critical infrastructure broadly, including physical or virtual systems and assets whose incapacity or destruction could have a debilitating impact on national security, national economic security, public health or safety. But the analysis argues that national security strategy has not fully caught up with the technological transformation of the American economy and military. A generation ago, it was relatively easy to understand why a power plant or port could be considered strategically important. Today, the same logic increasingly applies to the infrastructure that makes the digital economy possible. A data center supporting military logistics, financial markets, telecommunications or advanced artificial intelligence may be just as consequential to national security as a physical facility traditionally associated with defense.
The Trump administration has recognized the importance of data-center infrastructure to the internet, cloud computing, artificial intelligence and America's economic and national security. Congress should build on that recognition by creating a designation for exceptionally important American-owned or American-controlled digital infrastructure. The designation should be narrow and subject to rigorous requirements. It should not turn every data center into a national-security facility or give private companies a blank check for government protection.
Companies seeking the designation should have to meet strict standards concerning ownership and control, cybersecurity, physical security, supply-chain integrity, redundancy and cooperation with US national-security agencies. The federal government could then identify the relatively small number of facilities whose destruction or prolonged incapacitation would pose a serious threat to American national or economic security. These could include data centers supporting military operations, financial markets, critical communications, government systems or strategically important artificial intelligence capabilities.
The designation would not make these facilities American territory. A data center in Bahrain would not become sovereign American territory simply because it was designated a protected strategic asset. But it would establish something equally important: a clear American policy that deliberately attacking certain strategically vital infrastructure carries consequences. That clarity serves an important purpose: deterrence.
Congress should establish a range of potential responses that could include sanctions, asset freezes, diplomatic measures, defensive cyber operations and, depending on the circumstances and attribution, additional measures authorized by Congress. The goal should not be to automatically escalate every incident, but to make clear that attacks on designated digital infrastructure will be met with a deliberate and proportional response. The proposal reflects a broader shift in how national defense is understood. For most of American history, national defense has been understood geographically. There was American territory and foreign territory, borders to defend, military installations to protect and American forces stationed around the world. Even as warfare evolved, the basic concept remained relatively simple: the United States had physical assets that needed protection from foreign adversaries.
Technology has fundamentally changed that calculation. Today, some of the most important assets supporting America's economy, military and national security do not fit neatly within traditional definitions of territory or defense infrastructure. They are data centers, cloud-computing systems, telecommunications networks and other digital infrastructure that may be privately owned and located thousands of miles from the United States. The border of the next war may not be a line on a map. It may be a data center.