For millennia, combatants have sought to cripple adversaries by destroying the infrastructure that sustains them, poisoning wells, burning bridges, bombing railways and oil refineries. In the war now engulfing the Middle East, data centres have emerged as a new category of target. The conflict has produced what analysts believe are the first publicly confirmed physical attacks on hyperscale data centre facilities in a wartime context, with far reaching consequences for countries and peoples far removed from the battlefield, including New Zealand and Māori. One obvious example is the rising price of fuel in New Zealand right now.

The conflict began on 28 February 2026, when US and Israeli forces launched coordinated strikes against Iran in an operation the White House referred to as “Operation Epic Fury.” Tehran’s retaliation was swift and strategically sophisticated. On 1 March, Iranian drone strikes using what analysts have described as the Shahed, or “poor man’s cruise missile” hit two Amazon Web Services (AWS) data centres in the United Arab Emirates. A third AWS facility in Bahrain was damaged by debris from a nearby strike. Iran’s Islamic Revolutionary Guard Corps (IRGC) claimed responsibility, stating that the facilities were targeted for their perceived role in supporting US and Israeli military and intelligence activities.

The consequences included banking providers, payment systems, ride hailing apps, delivery services, and enterprise software platforms across the UAE experienced significant outages as AWS’s ME CENTRAL 1 and ME SOUTH 1 cloud regions went offline. Companies scrambled to migrate workloads to alternative regions. Days later, the US and Israel struck back, hitting at least two data centres in Tehran, one reportedly connected to the IRGC itself.

Iran simultaneously imposed a near total internet blackout on its own population, with connectivity dropping to roughly one percent of ordinary levels within four hours. It was the country’s second such shutdown in 2026 alone.

The Strategic Logic of Targeting Data Centres

The targeting of data centres reflects a deliberate and increasingly mainstream strategic calculus. Data centres now sit at the intersection of civilian economic life and military operational infrastructure, making them high value targets for any adversary seeking maximum disruption at minimum cost.

The dual use nature of commercial cloud infrastructure has fundamentally blurred the traditional boundary between civilian and military targets. The US military confirmed in mid-March that its war fighters were leveraging a variety of advanced AI tools in Operation Epic Fury systems helping soldiers sift through troves of data to make smarter decisions faster than the enemy can react, according to General Brad Cooper of US Central Command. American media reported that Anthropic’s AI model Claude which runs on AWS infrastructure was used by the US Air Force to assist with intelligence synthesis, target identification, and battle simulations during the conflict. Amazon and Google hold a combined $1.2 billion cloud services contract with the Israeli government, including with the Israel Defence Forces.

When a commercial data centre hosts both a citizen’s mobile banking app and a nation’s military targeting algorithms, it becomes a legitimate strategic target in the minds of adversaries, regardless of the civilian harm that follows. Iran’s decision to strike AWS facilities appears to have been a deliberate attempt to blind US forces and undercut their AI advantage by severing the infrastructure on which those capabilities depended.

AI Ethics at the Coalface of War

The conflict has exposed the deeply uncomfortable position of AI companies that have entered into military relationships and those that have refused to. In late February 2026, days before the war began, Anthropic CEO Dario Amodei refused a Pentagon ultimatum to grant the US military unrestricted access to Claude for “all lawful purposes.” The company drew two explicit red lines: Claude would not be used to power fully autonomous weapons, and it would not be deployed for the mass domestic surveillance of American citizens.

Defence Secretary Pete Hegseth responded by designating Anthropic a “supply chain risk to national security”, a label previously reserved for companies linked to foreign adversaries and ordered all federal agencies and military contractors to cease using the company’s products. Anthropic filed suit against the Pentagon on 9 March 2026. OpenAI, meanwhile, struck a deal with the Department of Defence within hours of Anthropic’s negotiations collapsing, a move OpenAI CEO Sam Altman later acknowledged the company “shouldn’t have rushed,” calling it “opportunistic and sloppy.”

Commercial AI infrastructure is simultaneously civilian technology, military hardware, and a political battleground and the companies that build it are being forced to choose what they are.

The Gulf’s AI Ambitions in the Crossfire

The strikes land at a particularly fraught moment for the Middle East’s ambitions to become a global hub for Artificial Intelligence. Before the attacks, the UAE’s data centre market was projected to more than double in value from $3.29 billion in 2026 to an estimated $7.7 billion by 2031. The planned Stargate UAE campus in Abu Dhabi, backed by OpenAI, Microsoft, and the Emirates’ G42, was set to become the largest AI facility outside the United States.

The war has thrown all of this into question. Gary Wojtaszek, CEO of Pure Data Centre Group, told CNBC that the conflict would cause his company to slow down in the region. Senior analysts at Morningstar note that relocating or closing facilities risks service level agreement breaches, reputational damage, and enormous financial cost. The near-term response will likely be cautious hedging, slowing new capital deployment, pausing partnerships, reassessing risk though a prolonged conflict could force more fundamental strategic reappraisals.

There are also supply chain consequences extending far beyond the region. Bromine and helium exports from the Middle East, both crucial for chipmaking, risk disruption if the conflict prolongs, adding further pressure to global semiconductor supply chains already stretched thin.

Physical Security

Protecting data centres from cyberattack has long been a priority for the technology industry. Protecting them from missiles and drone strikes is an entirely different proposition. Critical components such as cooling chillers, transformers, and air conditioning units are typically exposed on the exterior of facilities, making them vulnerable to strikes even when reinforced concrete walls protect the server infrastructure within.

Building underground, hardened data centres is technically feasible but costly and have been reported at over $2,000 per square foot in the United States, compared to roughly $1,000 for conventional construction. An underground facility also takes more than three years to complete, versus one and a half to three years for above ground builds. Experts at Semafor note that few data centre companies are taking the leap to build underground, though many are implementing enhanced above ground security features based on their location’s specific risk profile.

Experts have argued that data centres in conflict exposed regions should be designated as critical national infrastructure and protected by nationwide missile defence systems, like Israel’s Iron Dome. The broader security calculus also encompasses the seventeen submarine fibre optic cables passing through the Red Sea, which carry the majority of data traffic between Europe, Asia, and Africa. With Iran’s closure of the Strait of Hormuz and renewed Houthi threats in the Red Sea, both critical data chokepoints are simultaneously within active conflict zones, a scenario network analysts describe as unprecedented in the internet era.

Physical and Digital Attacks

The physical strikes have been accompanied by a parallel campaign of cyberattacks. Pro-Iranian hacking groups have targeted data centres, industrial facilities in Israel, a school in Saudi Arabia, and an airport in Kuwait since hostilities began. Hackers claiming Iranian affiliation were responsible for a significant cyberattack against US medical device company Stryker. They have also attempted to penetrate surveillance cameras across the Middle East, apparently to improve Iranian missile targeting accuracy.
>Online forums affiliated with pro-Iranian groups have stated plainly that “the datacentres need to be taken out,” according to researchers at the SITE Intelligence Group. Going forward, US defence contractors, government vendors, businesses with Israeli connections, and critical infrastructure such as hospitals, ports, water treatment plants, power stations, railways are all considered likely targets.

Rethinking the Architecture of Digital Infrastructure

The events of March 2026 have fundamentally altered how governments, militaries, and technology companies must think about digital infrastructure. The United States designates data centres as one of 16 critical infrastructure sectors; the United Kingdom afforded them that status in 2024; the European Union grants them special protective status as well. But the rise of drone warfare has exposed the gap between legal designation and physical protection.

For the technology industry, the primary near-term lesson is redundancy. Companies must invest heavily in backup plans, geographic failover capacity, and the ability to shift workloads rapidly between regions. The data sovereignty movement which calls for data to be stored and governed within national borders has also gained sudden urgency. As James Shires, co-director of the British think tank Virtual Routes, has noted, the attacks “really put into jeopardy the cloud and AI strategies of the Gulf economy in a really worrying way.”

 

Implications for New Zealand

While New Zealand sits far from the Middle East, it is not insulated from the vulnerabilities the Iran war has exposed. Like most nations, New Zealand relies heavily on cloud infrastructure operated by large US hyperscale’s such as AWS, Microsoft Azure, and Google Cloud, with data centres hosted in Australia and increasingly in regions far closer to geopolitical flashpoints. When AWS outages in the UAE and Bahrain disrupted banking, health records, and communications across the region, New Zealand organisations using those same cloud platforms felt ripple effects. In a more serious or extended conflict, those ripples could become waves.

New Zealand also sits at the end of a small number of submarine cable routes, connecting the country to the global internet. Any disruption to Pacific or Indian Ocean cable routes whether through conflict, sabotage, or collateral damage would disproportionately affect a small island nation with limited redundancy. The Iran war has demonstrated that these vulnerabilities are not theoretical.
Positives for New Zealand

Paradoxically, the crisis presents genuine opportunities for Aotearoa. As the global AI industry begins to reassess the risks of concentrating infrastructure in geopolitically unstable regions, New Zealand’s political stability, geographic remoteness from active conflict zones becomes significantly more attractive to data centre investors seeking lower risk alternatives:

• New Zealand could position itself as a safe, sovereign destination for AI infrastructure investment, capturing capital that was previously destined for the Middle East. Catalyst Cloud, iCloud, T4 Group and other local providers already offer genuinely sovereign infrastructure controlled entirely under New Zealand law.
• Unlike the UAE, which is perceived as aligned with US military interests, New Zealand’s independent foreign policy and its long tradition of nuclear free, non-aligned positioning may make it a more palatable host for international data infrastructure seeking political neutrality.
• New Zealand’s abundant hydroelectric and geothermal energy resources make it a natural home for data centres, which are among the world’s most energy intensive facilities, an advantage that will only grow as the AI industry faces scrutiny over its carbon footprint. But New Zealand must grasp these opportunities.
• The war has validated what sovereignty advocates have long argued, that data stored offshore is data at risk. New Zealand can leverage this moment to attract organisations, governments, and Māori that now see domestic data infrastructure as a strategic necessity, not a preference.
• Aotearoa could take a global leadership role in developing frameworks for the protection of civilian and indigenous data infrastructure in wartime, contributing to international law and norms around the status of data centres in armed conflict.

Risks for New Zealand

The same global trends that create opportunities also create new risks that New Zealand policymakers and communities must confront:

• The vast majority of New Zealand government agencies, hospitals, and businesses rely on offshore cloud platforms. An extended conflict or a broadened cyberattack campaign could disrupt services that New Zealanders depend on daily, including payments to health records to emergency communications, with no domestic fallback.
• Iran and its proxies have demonstrated a willingness to attack critical infrastructure in countries perceived as aligned with the US. New Zealand’s Five Eyes intelligence partnership with the United States, United Kingdom, Australia, and Canada may make it a target for Iranian state linked cyber operations, particularly against government systems, ports, utilities, and defence facilities.
• New Zealand’s geographic isolation means its internet connectivity is entirely dependent on a limited number of undersea cable routes. There is no land-based alternative. Any adversary willing to damage undersea infrastructure as demonstrated by attacks on the Nord Stream pipeline and Baltic cables in recent years could effectively isolate New Zealand from the global digital economy.
• If New Zealand attracts significant new hyperscale investment as a safe haven, it must be cautious about trading one form of dependency for another. Infrastructure owned and operated by foreign corporations, even if physically located in New Zealand, remains subject to the laws and priorities of those corporations’ home countries.
• New Zealand’s deepening engagement with AUKUS adjacent security arrangements and its Five Eyes commitments may increasingly draw it into geopolitical conflicts in which its digital infrastructure could be perceived as a legitimate target by adversaries.

Data as Taonga, Infrastructure as a Te Tiriti Obligation

Nowhere do the events of March 2026 resonate more acutely than in the context of Māori data sovereignty. Under Article Two of Te Tiriti o Waitangi, the Crown guaranteed to Māori the tino rangatiratanga the full chieftainship over their taonga. Data, in the digital age, is taonga. Whakapapa records, health data gathered through kaupapa Māori providers, tribal economic information, and the digital archives of iwi, hapū and hāpori are all expressions of who Māori are as a people, their lineage, their relationships, their futures.

Yet today, the very infrastructure that holds this taonga frequently sits in offshore data centres operated by foreign corporations, subject to foreign law, and now demonstrably vulnerable to foreign warfare. The Iran war has made plain what Te Tiriti demands: that the Crown has an active, ongoing obligation to ensure Māori taonga such as data are genuinely protected, not merely nominally recognised.

Positives for Māori

• The Iran war has powerfully validated what Māori data sovereignty advocates such as me have argued for years, that Māori data stored offshore is inherently at risk. The case for onshore, Māori governed infrastructure has never been stronger, or more legible to policymakers and the public.
• The geopolitical disruption opens a window for Māori to position themselves as architects of a sovereign digital future for Aotearoa through Māori owned data centres, partnerships with New Zealand based providers and frameworks grounded in tikanga that protect cultural IP from foreign law, foreign government override, and foreign conflict.
• Sovereign AI infrastructure provides a platform for te reo Māori voice recognition, AI translation tools, and digitisation of oral and cultural archives under Māori governance tools that are currently stalled partly because providers and Māori cannot agree on sovereignty terms.
• The development of Māori governed digital infrastructure is a concrete, practical expression of tino rangatiratanga, one that does not depend on Crown goodwill or legislative reform, but on Māori communities building and owning the infrastructure that holds their most precious knowledge.
• Sovereign digital infrastructure creates jobs, stimulates investment in Māori led technology enterprises, and builds long term economic capability contributing to the aspiration, documented by researchers, to lift Māori participation in the digital technology sector beyond its current five percent.

Risks for Māori

• Māori communities, who face systemic inequities in digital access and health outcomes, bear a disproportionate share of disruption when cloud outages affect banking, health records, and social services. The cumulative impact of offshore infrastructure failure on whānau, hapū, and iwi already navigating under resourced systems is greater than for better resourced communities.
• Māori data currently held on hyperscale platforms with infrastructure in the Middle East or in data centres elsewhere that could become conflict adjacent is demonstrably at physical risk. Health data gathered through kaupapa Māori providers, Māori economic records, and whakapapa archives held in foreign operated platforms have no guaranteed continuity in a wartime scenario.
• Just as colonial power was once exercised through land confiscation, digital colonialism may be exercised through the concentration of Māori data in infrastructure that Māori do not own, cannot govern, and cannot protect. The Iran war makes viscerally clear that this is not merely a philosophical concern it is a physical vulnerability.
• If New Zealand becomes a data centre investment destination but the governance frameworks that attract that investment do not incorporate Māori values, tikanga, and tino rangatiratanga, Māori communities’ risk being bystanders to a digital infrastructure boom on their own ancestral lands, an all too familiar historical pattern in a new register.

Conclusion

The technology industry has long traded in the comforting metaphor of “the cloud” vast, intangible, ethereal. The Iran war has stripped away that abstraction with brutal efficiency. The cloud runs on data centres. Data centres have an address. And that address can be hit by a drone.
For Aotearoa New Zealand, this moment is both a warning and an opportunity. Dependency on foreign owned, offshore hosted digital infrastructure is a strategic vulnerability that no small nation can afford to ignore. The opportunity is that New Zealand’s stability, sovereignty, and values including its Treaty obligations to Māori can become the foundation of a genuinely resilient, sovereign digital future.

For Māori, the Iran war makes the Te Tiriti based case for sovereign, onshore, and Māori governed data infrastructure a solution. Data is taonga and taonga must be protected, not just by the good intentions of foreign corporations or distant governments, but by the people to whom it belongs.

In the long sweep of history, every generation of warfare has found new infrastructure to target, the aqueducts of antiquity, the railways of the industrial age, the oil fields of the twentieth century. In the twenty first, it is the data centre’s turn. For indigenous peoples whose data represents not just information but identity, lineage, and sovereignty itself, this is not an abstract geopolitical observation. It is a call to act, to build infrastructure that cannot be taken away by the wars of others.

 

Sources: Al Jazeera, Axios, Bloomberg, CNBC, Euronews, Fortune, NBC News, Observer Research Foundation (ORF Online), PBS NewsHour, Semafor, Wall Street Journal (via Axios)