Iranian strikes on data centres threaten HE disruption
Iranian drone strikes on Amazon Web Services (AWS) data centres in the United Arab Emirates (UAE) and Bahrain have directly disrupted the higher education sector by disabling critical digital infrastructure, raising questions about the resilience of cloud systems in periods of high risk.
On 1 March, the strikes hit two AWS data centres in the UAE and one AWS data centre in Bahrain, causing structural damage, power outages, and fire and water damage, leading to prolonged service disruptions, according to the AWS health dashboard.
Further strikes hit the Bahrain AWS data centre on 24 March and 1 April, Reuters reported. The 1 April strike came a day after Iran’s Islamic Revolutionary Guard Corps (IRGC) threatened to target US tech companies operating in the Middle East, including Microsoft, Google and Apple, although Amazon was not on the list.
The 1 March strike was the first time in history that cloud data centres were deliberately targeted for military attack, according to Data Center Knowledge.
The strike affected educational institutions in the Arab region, where universities have increasingly migrated their core operations to these facilities, making them highly vulnerable to such physical infrastructure damage.
AWS advised customers in Bahrain to enact “disaster recovery plans”.
“Customers with workloads running in the Middle East take action now to migrate those workloads to alternate AWS Regions. Customers should enact their disaster recovery plans, recover from remote backups stored in other Regions, and update their applications to direct traffic away from the affected Regions,” the AWS warning said.
“For customers requiring guidance on alternate regions, we recommend considering AWS Regions in the United States, Europe, or Asia Pacific, as appropriate for your latency and data residency requirements.”
“The idea that bombs or drones could disrupt your workloads is no longer hypothetical,” noted Klaus Haller, writing in Data Center Knowledge.
“Geopolitical reality rendered philosophical discourse about resilience obsolete. The events of this past week have brought the risk into sharp focus: the cloud requires attention and a reassessment of operational resilience,” he wrote.
The cloud is “architected” for technical failures but not to withstand military attacks, he said. In future selecting a cloud region would be “a strategic decision about political stability, regional escalation risk, military defence capabilities and critical infrastructure protection”.
Impact on universities
Bouraoui Seyfallah, a professor of AI at the University of Sciences and Technology in Houari Boumediene, Algeria, told University World News that universities across the Gulf increasingly rely heavily on cloud services (including AWS) for teaching platforms, learning management systems, research activities, digital libraries and administrative systems.
“The targeting of major cloud and technology infrastructures in the Middle East – the first publicly confirmed military attack on a hyperscale cloud provider – could significantly disrupt the digital ecosystem on which many universities rely, hindering joint universities and tech company research projects and limiting access to cutting-edge technology and resources,” Seyfallah said.
For example, the University of Bahrain (UoB) migrated their entire IT infrastructure, including Student Information Systems (SIS), correspondence systems, and university portals, according to the AWS website.
The American University of Bahrain (AUBH) relies on Amazon WorkSpaces to provide a flexible desktop-as-a-service (DaaS) environment for students, and virtual learning in institutions like Hamdan Bin Mohammed Smart University (HBMSU) in the UAE moved all systems to AWS.
“Physical damage to the data centres meant that AWS essential services to UoB, AUBH and HBMSU were rendered inaccessible,” Seyfallah said.
“We’ve seen from previous global outages that even a temporary disruption – whether technical or otherwise – can quickly impact online classes, exams, and access to research data,” Seyfallah said.
“So the sector remains quite sensitive to any disruption of cloud infrastructure.”
University World News reached out to some of the affected universities in the Gulf States, including the University of Bahrain (UoB) and the American University of Bahrain (AUBH), as well as Hamdan Bin Mohammed Smart University (HBMSU), the American University of Sharjah, Ajman University and Zayed University in the UAE, but received no response.
A library director at one of the affected universities in the Arab Gulf States, who spoke on condition of anonymity, told University World News on 26 March: “The Iranian strike has affected the AWS services in the country, and it has its effects on university services and some of its internal IT services.” It had been “weeks since this issue started”.
The director said the university is working on solving this problem in collaboration with eGovernment. “They have already started moving to other cloud services and other AWS servers in the region,” the library director said.
On 1 March, Iran’s government-aligned Fars News Agency claimed that Iranian drone strikes on Amazon Web Services’ Middle East data centres were deliberate and had strategic significance.
In a Telegram post, the agency claimed Iran’s drone attack in Bahrain was intended “to identify the role of these centres in supporting the enemy's military and intelligence activities”.
Amazon Web Services confirmed a direct strike on two of its facilities in the UAE and a drone strike close to a facility in Bahrain, as well as disruption to services, on its dashboard. “These strikes have caused structural damage [and] disrupted power delivery to our infrastructure,” it said.
New strike hits Bahrain centre
The strikes were not a one-off event. On 24 March Amazon confirmed to Reuters that its Amazon Web Services region in Bahrain had been “disrupted” for a second time due to drone activity amid the current conflict in the region.
The company said it is helping to migrate customers to alternative AWS regions while it recovers, though it did not provide additional details such as the extent of the damage or how long it anticipates the disruption to last, according to Reuters.
On 25 March, the Information and eGovernment Authority in Bahrain confirmed that several government services and websites were facing “temporary technical difficulties”, Gulf Insider reported.
On 1 April a third incident occurred, with Amazon’s cloud computing operation in Bahrain damaged by a strike and a report that there was a fire in its facilities earlier in the day, Reuters reported.
Civilian vs military AI
Iran’s attack on Amazon Web Services AI data centres – and threats to other US tech companies – not only disrupts the cloud services on which many universities rely but also raises concerns about links between universities and global tech companies and the region’s dependence on US technology and the risk involved.
On 11 March, Iran's Islamic Revolutionary Guard Corp (IRGC) threatened to target offices and infrastructure owned by US companies with Israeli links that developed military tech, including prominent companies such as Nvidia, Google, Microsoft, Oracle, IBM, and Palantir, as well as cloud services providers, located throughout the Middle East, according to Al Jazeera.
The United States military has confirmed using a “variety” of artificial intelligence (AI) tools in the war with Iran. It is also known that the US military uses AI systems hosted on Amazon Web Services – such as Anthropic’s Claude – for intelligence analysis and war simulations, according to a 12 March Tech Policy Press report.
Professor Arshin Adib-Moghaddam, co-director of the Centre for AI Futures at SOAS, University of London, told University World News Iran has targeted data centres and digital infrastructure because they are seen as facilitating “the illegal war against the country”.
“Undoubtedly, the Iranian response has been disruptive throughout the monarchies of the Persian Gulf,” said Adib-Moghaddam, who is the author of The Myth of Good AI: A manifesto for critical artificial intelligence published last year.
“In the United States, we have witnessed an incredibly tight-knit integration of the tech sector into the military-industrial complex,” he said. “Universities have been embedded into this infrastructure. This unnecessary war will challenge some of these ties in the region,” Adib-Moghaddam said.
“There needs to be a clear distinction between civilian AI employed in universities and military AI, which needs to be under the supervision of lawmakers, connected to both domestic legislation and international law, as well,” Adib-Moghaddam argued.
Disruption to universities
Although universities are not the direct target of the attacks, the impact on them is potentially significant.
“Any interruption in services provided by companies such as Amazon Web Services, Microsoft, or Google may temporarily affect online teaching, data access, and international research collaboration,” Seyfallah said.
“The immediate consequence could be delays in academic activities and reduced access to critical research infrastructure.”
Sefallah said in the medium term, this situation may introduce greater caution in partnerships between universities and global technology companies.
“Research collaborations, joint innovation labs, and cloud-based research infrastructures could be reassessed in terms of geopolitical risk and digital security,” Seyfallah added.
“Universities may seek to diversify their technological partners and reduce dependence on a limited number of external digital platforms.”
Dr Marwan Al-Raeei, assistant professor and researcher at Damascus University in Syria, told University World News he agreed that the targeting of US tech companies in the Middle East could have several direct impacts on the operations and functions of universities in the Gulf states.
“There are impacts on funding and investment in the case of universities relying on partnerships with tech companies for funding research and development projects. If these companies face restrictions or backlash, it could lead to reduced financial support for academic initiatives,” Al-Raeei said.
“Targeting these companies may hinder joint research projects, limiting access to cutting-edge technology and resources.”
He said the fate of the UAE-US agreement to build the largest AI campus outside the US, which will include the world’s largest AI data centre, “remained to be seen”.
“Also, this [situation] may affect talent mobility. If US tech companies withdraw or limit operations in the region, it may affect the mobility of talent, including faculty and students, who might seek opportunities elsewhere,” Al-Raeei said.
“Partnerships with tech companies often influence curriculum development to align with industry needs. Disruptions in these partnerships could lead to outdated programmes that do not meet market demands.”
Raeei said in order to ensure “safe cooperation” with tech companies without using data for military purposes, universities could adopt several strategies such as clear agreements that outline the ethical use of data and prohibit military applications.
“This could include clauses that specify the intended use of research outcomes in addition to data governance policies,” Al-Raeei said.
Seyfallah said universities could continue cooperating with global technology companies, “but stronger governance frameworks” would be necessary.
“This includes transparent data management policies, independent academic oversight, and strict separation between civilian research data and any military-related applications,” Seyfallah said.
Local tech capacity
Al-Raeei suggested that greater caution regarding the dominance of US tech companies over the region’s digital infrastructure could spur development of local technology and data centres, which have less reliance on western companies.
Seyfallah also argued that the current situation highlighted the strategic importance of digital infrastructure in higher education.
“Universities are not only educational institutions but also key nodes in the knowledge economy," Seyfallah said.
“Therefore, universities in the region must increasingly invest in developing local technological capacity, including regional cloud infrastructure and university-owned data centres, in order to enhance digital sovereignty and resilience.
“Strengthening cybersecurity, diversifying technological partnerships, and investing in local research and computing infrastructure will likely become major priorities for universities across the Middle East in the coming years,” Seyfallah said.
However, Joseph Jarnecki and Noah Sylvia, both research fellows at the UK’s Royal United Services Institute (RUSI), wrote in a commentary on the data centre attacks on RUSI’s website that against the argument for cloud sovereignty, Hyperscale Cloud argues it can provide resilience that is not achievable through relying on data centres within a single national territory.
“Ukraine’s experience of expanding digital public services throughout Russian kinetic attacks further demonstrates this point, as does Estonia’s data embassy.”
Nevertheless, do they ask if the specific targeting of US technology companies, where it includes their data centres, changes the calculation of the risks involved in using those centres to promote resilience?
And if resilience involves shifting between cloud services in different regions, are the legal regimes sufficiently flexible to deal with that?
They say the strategic drivers for the expansion of data centres in the Gulf, which include the availability of cheap energy and sovereign wealth investment, as well as the location between East and West, remain, so the debate around these questions will continue.