Cloud services are spread across many machines, but those machines sit in a limited number of buildings. Drones that can reach those sites make physical security part of cloud reliability, not a side issue for facilities staff.
Key takeaways
- Cloud computing feels abstract to users, but every cloud service runs in physical buildings that need constant power, cooling and network connections.
- Cloud redundancy was mainly designed for accidents such as fires, floods and equipment failures, not for deliberate attacks on several sites at once.
- Cheap, widely available drones reduce the effort needed to threaten fences, rooftops, cooling equipment and power systems around a data centre.
- The strongest counter-argument is that data replicated across distant regions can survive the loss of a single facility, so well-built services may keep working.
Physical security is now part of cloud reliability
Ars Technica has announced a live discussion on whether the cloud can survive drone attacks on data centres. The publication says the livestream takes place on 17 November at 1 pm Eastern Time. The source does not say who is taking part or what they will argue, and this article does not guess. The question itself is worth explaining, because it challenges a common assumption about how modern digital life works.
The assumption is that “the cloud” is somewhere else and in some sense everywhere: spread so widely that no single event could disrupt it. In practice, cloud computing is rented capacity in data centres. These are large buildings full of servers, storage and network equipment, and they depend on electricity, cooling and fibre-optic links. Email, banking apps, workplace software, streaming, logistics systems and many public services run on this infrastructure.
The argument here is simple. Cloud architecture has become very good at handling failures that happen by chance. It is less clearly prepared for failures caused on purpose by someone who can choose the target, the timing and the number of sites. Drones matter because they lower the cost and skill needed to make that choice. If that is correct, cloud reliability can no longer be judged only by software design, backups and uptime figures. It also depends on how well providers and governments can protect a small number of physical locations from attack from the air.
This does not mean the cloud is fragile or that collapse is close. It means that one category of risk, long treated as rare and mainly a matter for building managers, now belongs in the same discussion as software engineering and cybersecurity.
Cloud infrastructure is concentrated in clusters
The first piece of evidence comes from how cloud providers organise their facilities. Large providers usually group data centres into geographic regions. Within each region there are several separate facilities or groups of facilities, often called availability zones. Customers are encouraged to spread workloads across these zones so that losing one building does not take a service offline.
This model is a real improvement on a single company server room. But it also concentrates capacity. Data centres tend to be built where electricity is plentiful, land is available, network routes meet and planning rules allow large industrial sites. Over time, some areas become hubs with many facilities close together, sometimes run by different companies but relying on the same power grid and fibre routes.
For accidental failures, this clustering works well. A transformer fault or a local flood rarely affects several separate sites in the same way. For a deliberate attacker, the picture is different. A cluster is a short list of targets. Facilities near each other can be reached on the same trip, and their locations are often easy to find because of their size and the infrastructure around them.
Many customers also do not spread their systems as widely as the architecture allows. Running across several regions costs more and is harder to build. Many organisations keep their main systems in one region and accept the risk. Exactly how common this is across the industry is not known from the source material. Still, the gap between what cloud design can do and what customers actually deploy is widely recognised. That gap is where physical attacks could cause problems beyond the damaged building.
Data centres rely on exposed supporting systems
The second piece of evidence concerns what keeps a data centre running. The server halls are usually well protected: strong walls, limited entry points, access controls and security staff. The supporting systems are often harder to protect.
Cooling is the clearest example. Servers produce a lot of heat, and many facilities remove it with chillers, cooling towers or heat-rejection units on rooftops or in open yards. These parts have to be outside to work. They are designed to withstand weather, not projectiles or explosives dropped from above. If cooling fails, operators may have to shut equipment down to prevent damage, even if no server has been touched.
Power is the second example. Data centres connect to the grid through substations and usually keep backup generators and fuel stores on site. Backup power is meant to cover grid outages for a limited period. It assumes the generators, switchgear and fuel supply are intact. Damage to these parts, or to the local substation outside the site, can take a facility offline as effectively as damage to the servers.
Network connections are the third. Data is only useful if it can move, and the fibre routes into a site may share entry points or run along predictable paths.
Fences and guards were designed for threats on the ground. A drone crosses the perimeter without dealing with gates or patrols. So the issue is not that data centres are weak buildings. The issue is that their critical supporting systems are exposed in exactly the direction that ground-based security was never built to cover.
Redundancy was built for accidents, not coordinated attacks
The third piece of evidence is about the assumptions behind redundancy planning. Engineers who design highly available systems usually assume that failures are independent. One disk fails, another keeps working. One building loses power, a building some distance away does not. The statistics that support high availability depend on failures being unlikely to happen at the same time.
A deliberate attacker breaks that assumption. An attacker who understands how zones are laid out can try to hit several at once, or strike while maintenance is already reducing capacity. Planning for independent failures does not protect against an opponent who coordinates them.
There is also a knock-on effect. When one zone or region fails, traffic and workloads move elsewhere. That extra load can stress the remaining capacity, especially if many customers fail over at the same time. Cloud outages caused by software faults have already shown that problems can spread through shared control systems in ways customers did not expect. A physical attack that triggers mass failover could create similar knock-on effects. The source material does not include any documented example of this happening after a drone attack, and this article does not claim one.
The case against: the cloud may be the most resilient option available
The strongest opposing view deserves to be stated fully, because it is substantial.
First, the alternative to the cloud is not a safer system. Most organisations that left the cloud would go back to their own server rooms or smaller hosting providers. Those facilities generally have weaker physical security, less redundancy and fewer engineers. Measured against what came before, large cloud providers are probably the hardest targets in commercial computing, not the softest.
Second, well-built services already survive the loss of whole facilities. Data copied continuously to distant regions, sometimes on different continents, can outlast the destruction of any single site. A drone with a small payload is unlikely to cause permanent data loss for a properly designed system. At worst it would cause a temporary outage while traffic moves elsewhere. Seen this way, the drone threat is mainly about availability for customers who chose not to pay for wider distribution, which is a business decision rather than a flaw in the cloud.
Third, the physical effect of a small drone is limited. Data centres are large, compartmentalised buildings. Damaging one cooling unit or generator does not necessarily disable the site, because operators usually keep spare capacity in these systems. A meaningful outage might need precision, repeated strikes or larger aircraft, and that raises the bar significantly.
Fourth, the history of cloud outages points to software as the bigger risk. Configuration errors, faulty updates and failures in shared control systems have caused disruptions that no single physical incident has obviously matched. If that remains true, spending heavily on airspace defence around data centres could pull money away from more likely failures.
Finally, physical attacks on infrastructure are not new. Power grids, pipelines and telecommunications sites have long faced sabotage, and states have legal, military and policing tools to respond. Data centres may simply be added to existing critical infrastructure protection rather than needing a new approach.
Taken together, these points suggest that “can the cloud survive?” is the wrong question. A better question is whether particular customers have built their systems to survive the loss of a site. For many, the honest answer is that they already could if they chose to.
Evidence that would change the conclusion
Several kinds of evidence would weaken or strengthen the argument made here.
The conclusion would weaken if attacks on data centres caused only short, contained disruptions that automated failover handled without noticeable effect on users. It would also weaken if drone detection and interception systems at critical sites proved reliable and affordable, so that aerial threats became a manageable cost rather than an open risk.
It would weaken further if independent analysis showed that most important services already run across several distant regions, so the gap between what the architecture allows and what customers actually deploy is smaller than generally assumed. Reliable public data on this is not currently available.
On the other side, the conclusion would strengthen if an attack on one facility caused failover problems that affected services well beyond its region. It would also strengthen if regulators began treating data centres formally as critical infrastructure with specific physical-protection duties, which would signal that governments see the risk as real. Disclosures from providers about incidents, near misses or changes to physical security would also be informative. Such disclosures are rare, and the source material does not include any.
Finally, more detail on how providers choose sites, separate zones and protect cooling and power systems would make it possible to judge the risk on evidence rather than assumption. The Ars Technica discussion may cover some of these points, but what it will say is not known before it takes place.
Sources and further reading
- Ars Technica, announcement of its live discussion on drone attacks against data centres and their implications for cloud services
- Public architecture documentation from major cloud providers describing regions, availability zones and multi-region resilience
- Guidance from national cybersecurity and critical infrastructure agencies on physical and cyber protection of essential services
- Industry and engineering literature on data centre design, including cooling, backup power and redundancy standards
Surfaced from the rss:arstechnica signal “drone threats to data centres”. AI-assisted draft, editorially reviewed.
