Data centres are now war targets. Australia's defence AI chief says that's a sovereignty problem

In March 2026, Iranian strikes damaged two Amazon Web Services data centres in the United Arab Emirates and a third in Bahrain during Iran's conflict with the United States and Israel. The facilities were civilian. The targeting logic was not.

Crozier testified at a parliamentary inquiry that data centres are legitimate wartime targets, and any military running its AI on someone else's cloud is inside the blast radius by default.

The shift is not about Amazon. The three Gulf facilities served commercial customers, including governments and militaries that had rented capacity from the same hyperscaler. Once a data centre is hit, every tenant loses it: the logistics planner, the satellite-imaging pipeline, the contractor running payroll, the allied force sharing a regional node. The spillover is the doctrine, not a side effect.

The vulnerability runs in two directions. The first is kinetic. The AWS strikes showed that a regional adversary can reach a Western cloud at scale. The second is contractual. Offshore AI providers could unilaterally disable access or hand over control to a foreign government. The combination of physical reach and vendor discretion is what makes rented compute a strategic liability for any military that needs one hundred percent uptime in a fight.

Australia's response, on the record, is geographic distribution disguised as a procurement deal. Defence signed a contract with Google last year for what Crozier described as a "disconnected hyperscale secret cloud": a meshed series of data centres, physically separated, with built-in redundancy designed to keep running if any single node is hit. The point is not raw capacity. The point is to hide in the noise. No single facility is large enough to be a high-value target, and no single outage takes the system down.

UNIDIR's "Clouds of War" brief treats data centres as dual-use infrastructure that has crossed the civilian-military line by accident of business model (UNIDIR). The Conversation's analysis of the AWS strikes argues the legal novelty is the spillover, not the targeting, and made the same point before the parliamentary inquiry (The Conversation). Tech Policy Press has tracked the legal and policy fallout for the companies and governments that shared the same pipes (Tech Policy Press).

The reader's test is the next cloud outage on the wire. If Azure, Oracle, or another takes a regional hit in the next twelve months, the spillover claim hardens into doctrine. If none of them do, it weakens back into anecdote. Until then, the working assumption holds: the data centre is a weapon surface, and every military that rents from a foreign hyperscaler is renting the weapon surface too.

Australia is the first country to put a name and a contract on the response. Whether the United Kingdom, Japan, the European Union, or India copy the distributed-redundancy pattern over the next twenty-four months is the watch item. The Google deal is a directional answer, not a finished one. Crozier framed it as hedging, and the source does not support a triumphalist read.