Servers Under Siege: How Data Centers Became the Front Line of Modern War

Foreign Affairs Forum | Dr. Antonio Bhardwaj (Dr. 🆎)| October 20th 2026

Executive Summary

Between the last days of February and the third week of October 2026, a boundary that military planners had long treated as theoretical was crossed again and again, and crossed deliberately.

Commercial data centers, the windowless warehouses of servers that hold the world's banking records, cloud applications, government databases and artificial intelligence models, became targets for drones and missiles.

Iran struck Amazon Web Services facilities in the United Arab Emirates and Bahrain, and a missile hit an Iranian bank data center that reportedly held payroll records for the country's armed forces.

From late September, Russia mounted a sustained campaign against Ukrainian internet providers and data centers in Kyiv and Odesa.

Ukraine answered in October by striking three of the six data centers operated by Yandex, the Russian technology group, and then the Balakovo facility of Sberbank, widely described as the largest in the country.

This FAF article argues that these strikes are not isolated tactical choices but evidence of a structural shift in how wars are fought.

Digital infrastructure has become the connective tissue of economies, militaries and information systems at once, and that triple function makes it irresistible to any belligerent seeking leverage at low cost. A single drone costing a few thousand $ can now impose losses on a facility worth hundreds of millions of $, and can do so while remaining below the threshold of a conventional escalation that might draw in a larger power.

Three conclusions follow.

First, the legal and moral protections that civilians once enjoyed in the digital realm are eroding faster than the law can adapt, because commercial clouds now host military workloads alongside hospital records and streaming services.

Second, the strikes have exposed a gap between the rhetoric of cloud resilience and the physical reality of concentrated, flammable, drone-vulnerable buildings.

Third, the economic ambitions of entire regions, above all the Gulf's aspiration to become a third global hub for artificial intelligence alongside the United States and China, now carry a security premium that few investors priced in.

The article closes with a set of practical steps for governments, cloud operators and international institutions: hardened and dispersed architecture, a clear separation of military and civilian workloads, new understandings under international humanitarian law, and diplomatic channels that treat digital infrastructure as a protected category before the next escalation rather than after it.

Dr. 🆎 has argued that the window for such measures is narrow, and the evidence of the past eight months supports that judgment.

Introduction

For most of the history of the internet, the physical machinery behind it was an afterthought. The cloud, as its name implied, seemed weightless, a utility that simply existed somewhere above the ordinary concerns of geography.

That illusion has been shattered in the course of a single year. The cloud has an address, a power supply, a cooling system, a perimeter fence and, as it now turns out, a vulnerability to the cheapest weapons on the modern battlefield.

Dr. Antonio Bhardwaj (Dr. 🆎), a polymath whose work on human-centered superintelligence for geopolitical strategy, artificial intelligence warfare and bioterrorism risk has made him a prominent voice on the intersection of technology and conflict, has described the moment in stark terms. "We spent two decades persuading ourselves that digital infrastructure was an abstraction," he observed. "The drones over Kaluga and the Gulf have corrected that error in the most expensive way imaginable."

The facts are by now difficult to dispute.

In the opening hours of the war that began on the 28th of February, when the United States and Israel launched strikes on Iran, Tehran blocked the Strait of Hormuz and struck Amazon data centers in the United Arab Emirates.

A third Amazon facility, in Bahrain, followed. Within two weeks a data center belonging to the Iranian state-owned Bank Sepah was hit by a missile. Iran published lists of what it called legitimate technology targets across Bahrain, Israel, Qatar and the United Arab Emirates, naming some of the largest American technology companies. Months later, in a second landscape of conflict, Russia began hitting the data centers of Ukrainian internet providers, and Ukraine retaliated against Russia's most important commercial computing sites.

What distinguishes this moment from earlier episodes of digital conflict is that the damage is physical, deliberate and openly acknowledged. Earlier eras of cyber warfare relied on deniability, on malware whose authors could not be proven and whose effects were reversible. A drone strike on a server hall leaves no ambiguity about attribution, and rebuilt servers cannot restore data that burned with the building.

This FAF article examines the phenomenon in eight movements. It begins with the historical lineage of attacks on communications infrastructure and the present status of the campaigns. It then traces the key developments of 2026, assesses the latest facts and the concerns they raise, analyzes the chain of cause and effect that produced the current moment, and proposes future steps.

A conclusion draws the strands together.Throughout, the analysis treats data centers not as a curiosity of the technology press but as a central concern of foreign policy, because the question of who may lawfully destroy what, and with what consequences for ordinary people, has always been the core of the laws of war.

History and Current Status

Attacks on the means of communication are as old as organized warfare.

Armies have always cut telegraph lines, jammed radios and bombed telephone exchanges, and the logic has never changed: an adversary that cannot communicate cannot coordinate. What has changed is the degree to which civilian life depends on the same channels that militaries exploit.

The twentieth century offered several precedents.

During the Gulf War of 1991, coalition forces struck Iraqi telecommunications and command networks in the opening phase of the air campaign, and the effect on Baghdad's ability to function as a state was immediate.

In 1999, during the Kosovo campaign, NATO bombed the headquarters of Serbian state television and used carbon-fiber munitions to disable electrical grids, provoking an enduring legal debate about whether broadcasting facilities and dual-use utilities were legitimate objects of attack.

The principle that emerged, imperfectly, was that a facility becomes a military objective when its nature, location, purpose or use makes an effective contribution to military action and its destruction offers a definite military advantage. That formulation, drawn from the first Additional Protocol to the Geneva Conventions, remains the foundation of the present debate.

The digital age introduced a different kind of conflict.

In 2007, Estonia endured weeks of disruptive cyber attacks on its banks, ministries and media. In 2010 the Stuxnet worm demonstrated that code could destroy physical machinery in an Iranian nuclear facility.

In 2017, the NotPetya malware, aimed at Ukraine, spread across the global economy and caused billions of $ in damage to shipping and manufacturing firms.

In the first hours of the full-scale Russian invasion of Ukraine in 2022, a cyber attack on satellite communications served as a prelude to the ground offensive. These episodes shaped a generation of strategic thinking in which digital conflict was understood as invisible, deniable and bloodless.

Ukraine's response to the early days of the invasion was itself a lesson in digital resilience. Facing the possibility that Russian missiles would destroy its government servers, Kyiv changed its laws to permit the storage of state data abroad and moved critical registries to commercial clouds in allied countries.

The decision was widely praised as visionary, and it became a template. Governments around the world concluded that the safest place for data was not within their own borders but across many jurisdictions, hosted by global hyperscale providers with the engineering resources to withstand disruption. For several years, that wisdom appeared to be vindicated.

The year 2026 has complicated the picture.

The distributed model protects against the loss of any single building, but it also draws commercial providers into conflicts that are not their own. When a cloud company holds sensitive workloads for the military of a belligerent, the buildings that host those workloads may cease to be purely civilian in the eyes of that belligerent's enemies.

Iranian officials made precisely that argument after striking Amazon facilities, asserting that the company served as a cloud provider for American military intelligence efforts. Legal scholars have noted that a data center used solely or primarily for military applications is a lawful target, while a facility that merely shares a roof with a defense workload presents a far harder question.

The current status of the campaigns is fluid.

In the Gulf, a fragile ceasefire between Iran and the United States has held unevenly while negotiations over the Strait of Hormuz remain stalled.

Mohsen Rezaei, the secretary of Iran's Supreme National Security Council, said in mid-October that cables, data centers and artificial intelligence facilities across the region could be targeted if intense fighting resumes, and he put the value of such assets at more than $2 trillion.

In Eastern Europe, the exchange of strikes on data centers is active. Russia's attacks on Ukrainian providers began in late September and continued into October, while Ukraine's attacks on Yandex and Sberbank facilities took place between the seventh and the middle of October. Neither side has signaled restraint.

Dr. 🆎 places this status in a longer arc. "The pattern we are seeing is the normalization of a category of target," he has said. "Once a belligerent has struck a data center and the world has responded with commentary rather than consequences, every future belligerent will treat that category as available."

Key Developments

The first and most consequential development was the Iranian decision, in the opening days of the war, to treat commercial cloud infrastructure as a legitimate instrument of pressure.

Within hours of the American and Israeli attack on the twenty-eighth of February, Iranian drones struck two Amazon Web Services data centers in the United Arab Emirates, and a further facility in Bahrain was hit soon afterward, with some reports suggesting that damage there was caused indirectly when a drone struck nearby.

The attacks degraded cloud services across the Gulf, forced Amazon to evacuate employees from a damaged site, and produced a degree of data loss that backup systems did not fully absorb. This was, by the assessment of several legal scholars, the first deliberate kinetic attack on commercial data centers by a party to an armed conflict.

The second development came on the 11th of March, when a missile struck a data center linked to Bank Sepah in Tehran, a facility reported to hold salary data for the Islamic Revolutionary Guard Corps and the Iranian army.

The same day, a news outlet affiliated with the Guard Corps published a list of 29 technology targets across Bahrain, Israel, Qatar and the United Arab Emirates.

A later publication from another Iranian outlet named Google, Amazon, Microsoft, Nvidia, Palantir, IBM and Oracle, declaring that as the regional war expanded into an infrastructure war, the scope of legitimate targets would broaden accordingly. In late March, Iranian military leadership asserted that cloud facilities hosting American defense workloads were legitimate military objectives under international law.

The third development was repetition.

A second Iranian missile attack on an Amazon data center in Bahrain followed in late July, and the Iranian regime justified it in a public message by citing the company's role as a cloud provider for American military intelligence. By early August, American and Iranian forces together had attacked at least five data centers in the Gulf. The repetition mattered because it transformed an astonishing event into a pattern, and a pattern is what turns an exception into a doctrine.

The fourth development shifted the landscape to Europe.

In the last week of September, Russia began a campaign against Ukrainian internet infrastructure with a pace and focus that marked a departure from its earlier attacks on fiber lines and cell towers. On the twenty-third of September, a Kyiv data center housing equipment for the provider UTELS was damaged, and roughly one hundred thousand households in the Kyiv region temporarily lost internet access.

On the following day, providers including Domonet, Kievnet and Faust reported damage, and a data center hosting the infrastructure of MiroHost was destroyed. Strikes then reached facilities belonging to Kyivstar and the national operator Ukrtelecom.

By the first of October, the Parkovy data center in Kyiv had ceased operations entirely, and the Dline.ua data center had been destroyed. The company Omega Telecom later reported that a facility lost in the same attack had stopped working. On the tenth of October, a strike on Odesa hit the provider TENET.

Russia acknowledged that it was deliberately targeting facilities that support Ukraine's internet network.

The fifth development was the Ukrainian reply. Between the seventh and eleventh of October, Ukrainian drones struck three of the six data centers operated by Yandex, in Sasovo in the Ryazan region, in Kaluga, and in the Vladimir region.

The Kaluga site, a campus of roughly one hundred thirty thousand square meters with about three thousand eight hundred server racks and a capacity of 63 megawatts, was designed to be the largest of Yandex's facilities, and Russian state media conceded that several of its modules had been taken out of service completely.

Reporting indicated that Yandex Cloud traffic fell to roughly 30% of its normal level and that dozens of services serving tens of thousands of customers were disrupted.

Russia's digital development minister described the attack as unprecedented. President Volodymyr Zelenskyy confirmed the strikes, saying that Ukraine always responds in kind, while adding that Ukrainian forces must not violate international humanitarian law.

The sixth development followed in mid-October, when Ukrainian drones struck the Balakovo data center owned by Sberbank, the country's largest bank and technology company, in what appeared to be an effort to hamper Russia's ambitions in artificial intelligence.

The attacks on Yandex and Sberbank thus pointed beyond the immediate logic of retaliation toward a strategic aim: slowing the computing capacity on which Russian artificial intelligence development depends.

Dr. 🆎 reads the sequence as evidence of mimetic escalation. "Each side justifies its strike by pointing to the other's," he has noted. "That is the classic grammar of a security dilemma, but in this case the thing being traded is not territory or hardware. It is the substrate of modern civilian life."

Latest Facts and Concerns

The latest facts, as of the third week of October 2026, are sobering.

In the Gulf, the Iranian security chief Mohsen Rezaei responded to what he called an insufficient American reply to Tehran's proposal for ending the war by warning that cables, data centers, artificial intelligence facilities and other sites could be hit if fighting intensifies.

Iranian hardliners and the Guard Corps-affiliated Tasnim news agency backed the threat, publishing an argument that attacks on artificial intelligence centers could undermine American technological competition with China, deter investment and pressure American financial markets.

On the eighteenth of October, Iran's parliament confirmed a missile-program veteran as defense minister, and the parliament speaker announced that a Persian Gulf Data Authority would be established, a proposal that signaled Tehran's intention to assert regulatory control over the region's digital flows.

Whether these statements reflect operational planning or an effort at deterrence remains unclear, but the direction of travel is not in doubt.

The geography of the threat deserves emphasis.

The Gulf is a convergence point for submarine fiber-optic cables carrying much of the traffic between Europe, the Middle East, South Asia and East Asia, and the nearby Red Sea corridor, where Iran's Houthi allies hold a chokepoint, carries more than 90% of data capacity between Europe and Asia according to industry estimates.

Analysts caution that Iran could cause significant regional disruption without being able to destroy the Gulf's digital infrastructure systematically, and an Iranian commentator himself acknowledged that the effects would fall primarily on regional networks rather than the global internet.

Yet regional disruption is no small matter for economies that have staked their futures on digital transformation.

Gulf governments have pledged vast sums to data centers and artificial intelligence campuses, with the Qatari sovereign wealth fund and the American investor Blue Owl having launched a $3 billion data center initiative in September 2025, and analysts have estimated that regional commitments run into the trillions of $.

The concerns in Eastern Europe are different in kind but equal in gravity.

Ukraine's internet has shown remarkable resilience.

Experts have noted that Russian strikes on Ukrainian providers caused problems for less than 3% of subscribers for only a few hours, and that the decentralized structure of the country's networks, with thousands of providers, each with its own facilities, makes a total blackout improbable.

But resilience is costly. Backup infrastructure, redundant routes and out-of-country hosting are expensive, and smaller providers often cannot afford them.

The Ukrainian government has responded by simplifying the leasing of state property for data centers and telecommunications providers, accelerating relocation, and strengthening the protection of critical communications infrastructure.

Russia faces a different problem.

It has more than one hundred data centers on its territory, but its international redundancy options are limited by sanctions and by the dependence of its services on domestic infrastructure.

Reports from Moscow indicate that other data center owners have begun buying anti-drone equipment, adding to costs, and that demand has risen for mobile data processing units.

A senior executive at the state-controlled operator Rostelecom publicly called for what he described as a doomsday data vault, a hardened repository capable of surviving attack. The Russian digital ministry has opened discussions with the defense ministry on protecting data centers.

A less anticipated consequence concerns information operations.

Cybersecurity researchers observed that bot traffic on social media associated with Russian networks fell to roughly 49% of its usual level after the strikes on Yandex, and President Zelenskyy remarked publicly that it became easier to breathe on many platforms once Yandex's data centers went offline.

This is a revealing finding, because it demonstrates that the digital propaganda machinery that preoccupies Western policymakers rests on buildings that can be struck, and it complicates the ethical calculus. A strike that reduces disinformation may be welcome, but it also demonstrates that the destruction of civilian-serving infrastructure can be justified by any belligerent through a claim of strategic benefit.

The deepest concern is legal.

Scholars have noted that international humanitarian law was drafted for a world of front lines and munition factories, and that servers hosting an algorithm for a defense contractor were never contemplated by its authors.

The principle of distinction requires belligerents to distinguish between civilian objects and military objectives. The principle of proportionality forbids attacks in which expected civilian harm would be excessive in relation to the anticipated military advantage.

A facility that hosts both a bank's customer records and an intelligence agency's analytic workloads straddles both categories, and the harm from striking it falls on millions of people who have nothing to do with the war. Some experts argue that, at present, the destruction of data centers causes far more civilian damage than military advantage, and that data centers should not be considered lawful targets.

Others observe that a facility supporting artificial intelligence-enabled targeting may well qualify. Reports that AI-assisted systems helped identify and prioritize roughly one thousand targets in Iran have sharpened the argument about whether commercial computing is now a component of the kill chain.

Dr. 🆎 is blunt on this point. "If a commercial data center is embedded in the targeting process, its operators have, whether they intended it or not, become stakeholders in the war," he has argued. "The law has not yet decided what that means, and in the meantime the people who bear the cost are customers who never consented to being near a front line."

Cause-and-Effect Analysis

The first causal chain begins with the economics of cloud concentration.

Over the past decade, governments and corporations migrated workloads to a handful of hyperscale providers because the economic logic was compelling: scale reduced cost, specialization improved security and global distribution promised resilience.

The consequence of this concentration was that the loss or disruption of a few sites could ripple across a wide range of services. When a single availability zone in the Gulf goes dark, banks, delivery platforms, government portals and hospitals feel the effect simultaneously. The efficiency that made the cloud attractive in peacetime made it brittle under bombardment.

The second chain begins with the economics of drones.

Cheap, mass-produced one-way attack drones have transformed the relationship between offense and defense. A data center is a large, fixed, thermally conspicuous structure, often located in industrial parks with predictable power connections and publicly known coordinates, and it is very difficult to conceal. Intercepting a swarm requires layered air defenses that cost more per engagement than the attacking weapons.

The result is an asymmetry in which a belligerent with limited conventional strength can impose disproportionate costs on a richer opponent. Iran understood this when it concluded that economic pain could offset military inferiority, and Ukraine and Russia both understood it when they turned their long-range drone programs toward digital infrastructure.

The third chain is legal and normative.

International law provides no explicit rule on data centers. In the absence of such a rule, belligerents exploit ambiguity.

The moment one side declared that a cloud facility serving military customers was a lawful target, the burden shifted to its adversaries to prove the contrary, and the commercial providers found themselves in the unfamiliar position of defending the civilian character of their buildings while simultaneously selling services to defense ministries.

The causal logic runs from legal ambiguity to strategic opportunism and then to normalization. Each strike that passes without sanction reinforces the next.

The fourth chain concerns reciprocity and the escalation spiral.

Ukrainian officials explicitly described their strikes on Yandex as a response to Russian attacks on Ukrainian providers.

The Iranian regime explicitly described its attacks on Amazon as a response to American and Israeli aggression. Each stakeholder frames its strikes as proportionate retaliation, and each retaliation invites another round.

The danger is not simply that the cycle continues but that it climbs. Today's targets are providers and cloud regions; tomorrow's may be undersea cables, internet exchange points, satellite ground stations and the power plants that feed server halls, any of which can multiply the civilian harm.

The fifth chain is economic and geopolitical.

The Gulf states have invested heavily in the ambition of becoming a global artificial intelligence hub, courting American chipmakers and cloud providers with promises of cheap energy, capital and political stability. Iran's strikes struck directly at that ambition.

The result is a repricing of risk. Insurers, investors and boards must now ask whether a data center built in a contested region can be insured, whether it can be defended and whether the sovereign data stored within it is safe. Meanwhile, the logic of data localization, which many governments adopted to protect national sovereignty, now sits in tension with operational security, because keeping data inside one's borders concentrates it where it can be struck.

The sixth chain is technological.

The rapid expansion of artificial intelligence has increased demand for computing capacity at precisely the moment when computing facilities have become military targets. Advanced chips, high-density power and liquid cooling make modern data centers even more valuable and more fragile than their predecessors.

A strike on a single large facility can set back a national program by months. That is why attacks on Russian facilities have been read as attacks on Russian artificial intelligence ambitions, and why Iranian commentary has described artificial intelligence centers as natural targets in a technological competition with China.

The final chain concerns the human and political consequences.

Ordinary people suffer first. A Kyiv resident who loses internet access cannot reach emergency services, relatives or news. A merchant whose terminal cannot process payments cannot sell goods. A hospital that loses access to cloud-hosted records cannot treat patients efficiently. In authoritarian systems, the loss of a major platform may also have unexpected political effects, whether the fall of propaganda bot networks or the breakdown of surveillance tools. These effects do not map neatly onto military advantage, which is why the proportionality question is so difficult.

Dr. 🆎 summarizes the chain of causation in a single sentence. "We built a civilization on shared digital infrastructure, we then put that infrastructure in the path of wars, and we are surprised that wars have found it," he has said. "The failure is not technological. It is a failure of imagination, and of governance."

Future Steps

The challenge is to prevent the normalization of attacks on civilian digital infrastructure while accepting that some facilities may, under certain conditions, lawfully lose their protection. Six steps merit consideration.

The first step is architectural.

Operators and governments should design for physical resilience as seriously as they design for cybersecurity. That means dispersing capacity geographically within and across jurisdictions, hardening critical halls against blast and fire, installing layered air defenses and electronic countermeasures at high-value sites, maintaining backup power and cooling that do not depend on a single feed, and building underground or semi-underground facilities where threats are persistent. Ukraine's experience with relocating data centers abroad and with building underground networks offers a practical model, and Russia's belated interest in mobile data processing units and a hardened data vault shows that even the aggressor now sees the need. Cloud companies should also publish clear resilience standards for regions near active conflict.

The second step is the separation of military and civilian workloads.

The most effective protection for civilian data centers is clarity. Military customers should be hosted in dedicated, clearly designated facilities, or in segregated and transparently labeled zones, so that civilian infrastructure can credibly claim immunity. Governments that rely on commercial cloud providers for defense purposes should recognize that doing so may turn those facilities into targets, and should compensate by funding hardening, offering protection or maintaining sovereign military clouds. The practice of distributing military workloads across several commercial providers may spread risk, but it also spreads the targeting problem across the civilian economy, and policymakers should weigh that trade-off honestly.

The third step is legal clarification.

The international community should convene states, legal scholars, the International Committee of the Red Cross and industry representatives to develop an authoritative interpretation of how existing humanitarian law applies to data centers and cloud services. The upcoming United Nations mechanism on information and communication technologies in the context of international security offers a natural forum. A voluntary norm declaring that data centers serving essential civilian functions should be protected, in the manner of hospitals and water systems, would be a valuable start. Even if such a norm cannot be universal, its adoption by a coalition of states would shape the expectations of the next conflict.

The fourth step is diplomatic.

In the Gulf, the immediate priority is to prevent a resumption of intense fighting, and negotiators should treat digital infrastructure explicitly in any settlement. A ceasefire that is silent on cables and data centers leaves a major threat unaddressed. Regional states, including those hosting American hyperscale facilities, should consider communicating directly with Tehran on the protection of commercial infrastructure, while Washington should clarify whether and how American defense workloads are hosted on commercial platforms in the region. In Eastern Europe, even limited understandings on civilian internet providers could reduce harm, though the prospects for such understandings appear slim without a broader settlement.

The fifth step is economic.

Insurers, sovereign wealth funds and technology companies should integrate geopolitical risk into the siting and financing of data centers. Governments competing to host artificial intelligence capacity by 2030 should be candid with investors about the security environment and should invest in defenses commensurate with the value of what they host. Diversification across regions, including in stable democracies with strong energy sectors, would reduce the leverage that a belligerent can obtain by threatening a single cluster.

The sixth step is institutional.

States need national plans for digital continuity that treat data centers as critical infrastructure on a par with power grids and water networks. Those plans should include emergency procedures for rapid migration of essential public services, contractual obligations on cloud providers to maintain service continuity, regular exercises that simulate the loss of major facilities and mechanisms for public communication during outages. By 2036, nations that have built such systems will be markedly more resilient than those that have not, and the difference may prove decisive in a crisis.

Dr. 🆎 emphasizes that governance of the human element will matter as much as hardware. "Human-centered design means asking, before every deployment, who is exposed if this system is attacked and who decides on their behalf," he has said. "The answers should not be left to procurement departments."

Conclusion

The strikes on data centers in the Gulf and in Eastern Europe have revealed a truth that the technology industry preferred not to contemplate: the digital world is anchored in physical buildings, and physical buildings can be destroyed.

The belligerents who have turned to these targets have done so for reasons that appear rational from their own perspectives. For Iran, data centers offer a means of imposing economic pain on far stronger opponents and on the states that host them.

For Russia, attacks on Ukrainian providers offer a way to degrade communications and morale. For Ukraine, strikes on Yandex and Sberbank offer a means of retaliation, of slowing a rival's artificial intelligence ambitions and, apparently, of disrupting online influence networks.

Yet rational for the belligerent does not mean wise for the world. A norm that permits the destruction of commercial computing facilities in wartime would expose every society that depends on the cloud, which is to say virtually every society.

The harm would fall on the civilian economy first, on hospitals and merchants and students, and only afterward, if at all, on the war machines that supposedly justified the strikes. The spread of drone technology, the growth of artificial intelligence workloads and the intertwining of military and civilian systems all indicate that the problem will intensify unless states and companies act.

The window for action is open but narrow.

Iran's latest threats, voiced as negotiations stall and a fragile ceasefire holds, show how readily digital infrastructure has entered the vocabulary of coercion. The Russian and Ukrainian campaigns show that the practice has crossed regional boundaries. What remains undecided is whether the international community will respond by building protective norms and resilient architecture, or by waiting until a more catastrophic strike makes the lesson unavoidable.

Dr. 🆎 offers a final reflection. "The measure of a civilization is not whether its infrastructure can be attacked, because all infrastructure can," he has said. "It is whether that civilization has decided in advance what it will protect, and has built the courage and the institutions to protect it."

The FAF article ends where it began, with the proposition that the cloud has an address.

The task for policymakers, engineers and diplomats is to ensure that the address is not simply a target.