For years, the data centre industry's approach to resilience has focused on familiar challenges: power failures, cooling disruptions, connectivity issues and cyberattacks.

But what happens when the data centre itself becomes the target?

Recent reports of strikes affecting digital infrastructure in Russia and Ukraine have brought a different dimension of risk into focus. As computing capacity becomes increasingly important to national economies and security, the infrastructure supporting it is also becoming a strategic (hard) target. Journalist Chris Miller recently explored this issue in the Financial Times, arguing that data centres need protection from drone warfare.

For an industry racing to deliver unprecedented levels of new capacity, this raises an important question: are we designing data centres for the full range of risks they may face over their operational lifetime? 

From commercial asset to strategic infrastructure

The UK designated data centres as Critical National Infrastructure (CNI) in September 2024, recognising their essential role in supporting the economy and society. The Autumn Budget 2026 reinforced that signal, with the British Data Centre Covenant offering qualifying projects enhanced support in securing grid connections, alongside ambitions to strengthen national data sovereignty and resilience against cyber and hybrid threats.

But designation is the easy part. The harder question is what legal obligations, government support structures and regulatory expectations actually follow from it. A CNI label without the legal and commercial architecture to back it up remains an incomplete commitment.

The consequences of a targeted attack extend well beyond physical damage. An attack affecting power, cooling or connectivity could interrupt critical services, while the loss of specialised equipment with long replacement lead times could prolong recovery. Physical and cyber threats are also increasingly interconnected. A cyberattack on operational technology could cause physical disruption, and vice versa.

There is also a growing tension between efficiency and resilience. The industry has spent years pursuing economies of scale, concentrating significant computing capacity in individual locations. That makes commercial and operational sense, but concentration can also create exposure.

Ukraine learned this early, moving much of its government data to servers elsewhere in Europe after strikes in 2022. Estonia had already gone further with its ‘data embassy’ in Luxembourg: a secure facility holding backups of critical state data, protected under diplomatic-style arrangements. Both illustrate an important alternative: resilience is not necessarily about protecting everything in one place. Sometimes it’s about ensuring everything does not depend on one place.

Rethinking resilience: Bigger, stronger or decentralised?

Does this mean the era of the mega-campus is coming to an end? Probably not. 

AI demand, economies of scale and power availability will continue to drive large-scale development. But the discussion may increasingly shift from how much capacity can be concentrated in one location to how that capacity can be protected, distributed and recovered following disruption.

Physical hardening, enhanced access controls, diversified power and connectivity routes, and geographic replication of critical workloads may all form part of the response. The appropriate measures will depend on the location, function, threat profile and criticality of each facility.

Of these emerging physical threats, drones warrant particular attention. The conflicts in Ukraine and the Middle East have shown how cheaply and effectively drones can be used to disrupt critical infrastructure, and the barrier to entry continues to fall. ‘Counter drone’ is often used as shorthand for a range of activity, starting with spotting a drone and understanding what it's doing, and only then moving to intervention. For private data centre operators, it’s the intervention end that is hardest: measures that disrupt a drone’s signals or attempt to take control of it are tightly constrained under current law and are generally reserved to public authorities. 

The new MOD led drone regulation unit announced in the 2026 Autumn Budget is a welcome development on the operation and oversight of drones, but it doesn’t answer the immediate question of what private operators can lawfully deploy to protect their sites from them. Until there’s a clear licensing or authorisation route for proportionate defensive measures at CNI sites, operators will struggle to budget and insure for a credible response, and to contract for it with confidence. That makes it as much an investment and contracting problem as a regulatory one.

The investment gap

Hardening infrastructure against an evolving and hybrid threat landscape is also, fundamentally, a capital question. Physical hardening, redundant systems and geographic distribution carry significant cost. This comes on top of planning constraints, grid delays, equipment shortages and rising construction costs already stretching project economics.

Private and institutional capital will not flow into resilience investment without a framework it can build a business case around. The Budget's £5bn commitment through the National Wealth Fund and British Business Bank for defence, dual use and other sectors that support resilience and national security signals intent, but as industry bodies have noted, the detailed plan needed to invest with confidence is still to come. 

Looking ahead: Closing the gap

The appetite is there, but data centre companies can’t afford to wait until the necessary reform materialises. Our specialist teams can ensure you remain fully up to speed on the regulatory landscape and are positioned as strongly as possible to manage risk, meet compliance obligations, and demonstrate resilience against the full spectrum of evolving threats – today, not just when the policy catches up.

Browne Jacobson's construction and infrastructure team advises developers, investors and occupiers on the full lifecycle of complex infrastructure projects, including the contractual and procurement frameworks underpinning data centre development at scale. Our security, defence and national security team works with industry and government on the legal and commercial structures needed to translate policy commitments into investable programmes, including financing models, procurement reform and regulatory engagement.

If you would like to discuss how these developments may affect your organisation or projects, please get in touch.