Recent Iranian threats against the Gulf digital infrastructure highlight the critical need for Gulf states to safeguard their investments in a future economy built on Artificial Intelligence and data processing. Senior Islamic Revolutionary Guard Corps (IRGC) official Yadollah Javani said last month that seven internet cables passing beneath the Strait of Hormuz could become targets should Iranian infrastructure come under renewed American attack. Top security official Mohsen Rezaei also warned that U.S.-linked data centers and AI facilities in the Gulf could also be attacked if Washington were to resume military operations against Iran. Iranian security officials have further signaled that Tehran has detailed plans to attack subsea cables in the Gulf and obstruct efforts to repair them.
The Gulf states have bet heavily on the digital sector as part of their economic future. The UAE is building a five-gigawatt AI complex in Abu Dhabi; Saudi Arabia’s new AI firm Humain aspires to develop massive computing capabilities; and in December last year, Qatar’s Qai—a subsidiary of the Qatar Investment Authority—announced a $20 billion joint venture with Canadian multinational Brookfield to invest in AI infrastructure. Qatar’s Digital Agenda 2030 views the digital economy as key to diversifying the country’s revenues.
For years, military attacks on data centers were little more than scenarios buried in expert reports. Yet in March, days into the U.S.-Israeli war with Iran, Iranian drones struck two Amazon Web Services (AWS) facilities in the UAE. Another strike hit near an AWS facility in Bahrain, which experienced a second disruption in April. The same month, the IRGC published a list of potential targets, including Google, Meta and Apple assets as well as those of Emirati company G42. Six months later, in September, the company announced that it was no longer able to recover data that had been stored exclusively within an Availability Zone—an isolated physical data center—in the UAE.
In Bahrain, several areas were damaged simultaneously, overwhelming backup systems. While most firms were relatively unscathed, having relocated operations early or maintained backups outside the region, the episode served as a stark reminder that these facilities had been built to withstand intruders, fires, and power outages—not military attack drones.
Exposed Arteries and Compound Vulnerabilities
According to the International Telecommunication Union (ITU), submarine cables carry over 99 percent of international internet traffic; the Red Sea alone accounts for more than 90 percent of data capacity between Europe and Asia.
The region was well aware of the vulnerability of these arteries before the recent conflict. In February 2024, three cables in the Red Sea were damaged—likely by the anchor of cargo ship Rubymar, which had drifted after the vessel was struck by a Houthi missile. Repairs took several months. In September 2025, two cables were severed near Jeddah, causing internet slowdowns across the Middle East and South Asia and forcing Microsoft to reroute data traffic via longer paths.
The International Cable Protection Committee notes that the Strait of Hormuz carries less than one percent of international internet capacity. That detail may seem reassuring, but for the Gulf states, the reality is quite the opposite—they would suffer the bulk of the impact, meaning they are the main targets of the threat. Furthermore, only about 60 vessels worldwide are capable of repairing undersea cables, and many are nearing the end of their operational lifespans. Should Iran obstruct repairs following an attack, an outage that should last just days could extend for months.
Data centers rely on three essential elements: a stable electricity supply, continuous cooling, and high-speed global connectivity. In the Gulf, these elements are inextricably linked to energy and water infrastructure. Massive AI data centers consume vast amounts of electricity; some rely on desalinated water for cooling. In Qatar, the concentration of gas, power and desalination facilities in the Ras Laffan Industrial City creates a single, consolidated target, where a strike on an energy facility could also disable a data center that was not even the intended target. Damage to the AWS facilities described above was not limited to direct hits; it also stemmed from power outages and damage caused by the water used to extinguish the fires.
Experts note that while users may experience the internet as a detached cloud, in reality it relies on a limited number of coastal landing stations and narrow maritime corridors. This geographical concentration makes the network far more susceptible to disruption than many realize.
The impact of strikes on such facilities goes well beyond physical damage. Attracting investment in data centers and similar technologies demands stability and guaranteed continuity of service. The war has driven up insurance costs and delayed certain projects, leading Gulf-based clients to begin seeking computing capacity in India. Furthermore, major cloud computing companies have explored relocating a portion of their operations from Dubai, Abu Dhabi and Oman to India and Singapore. Consequently, the Iranian threat is intended as a form of deterrence, a message to Gulf governments as much as to Washington. Accordingly, the countries that are most deeply integrated with American technology firms are also the most exposed.
This presents a pressing dilemma for Gulf states. While partnerships with U.S. companies have provided them with access to advanced microchips and technical expertise, they have also placed local tech infrastructure within the military calculus around any confrontation between Washington and Tehran. Furthermore, the targeting of data centers raises unresolved legal questions. Neither the Convention for the Protection of Submarine Telegraph Cables—which dates back to 1884—nor the UN Convention on the Law of the Sea offer sufficient wartime protection for such infrastructure. Moreover, facilities that serve civilian sectors, such as banks and hospitals, could simultaneously host services for military entities, leading adversaries to classify them as legitimate targets.
Protecting the Gulf’s Data
Safeguarding the Gulf’s digital economy requires an institutional response, including measures by individual companies. This can be summarized through five key tracks.
The first involves designating data centers, AI hubs and cable landing stations as critical national infrastructure—thus entailing mandatory security standards, operational continuity planning and an obligation to report incidents. The second focuses on geographic diversification: establishing alternative terrestrial fiber-optic routes between the GCC states, distributing data centers across multiple locations, and maintaining backups of sensitive data beyond the reach of potential threats. The third track concerns physical protection: integrating major data centers into aerial and anti-drone defense systems, while fortifying the power and cooling infrastructure they rely on.
The fourth track focuses on building a regional Gulf capacity for repairs—maintaining a fleet of repair vessels and a stock of cables and spare parts within the region, and establishing a joint mechanism for monitoring subsea cables. This could be modeled on NATO’s Baltic Guardian mission, launched in January 2025 following the severing of cables in the Baltic Sea. The fifth track is diplomatic. Qatar has advocated for a regional and international understanding to prevent waterways from being weaponized—a framework that should naturally extend to digital infrastructure, ensuring that the protection of cables and data centers becomes a core component of any de-escalation agreement.
The experience of recent months demonstrates that the digital economy, which the Gulf states see as key to diversifying their national economies, rests on a physical foundation that is inherently vulnerable. Data stored in the cloud could be lost forever should a missile strike the facility housing it. It must be emphasized that digital security has become an integral component of national security. A state that prioritizes the protection of its digital infrastructure within its defense and economic planning—and collaborates with its neighbors to achieve this—will remain a secure destination for investment and data, regardless of how intense the surrounding tensions or crises may become.
