The cloud has coordinates

The cloud has coordinates. For twenty years the cloud sold itself as placeless — an abstraction you rented by the hour. Then Iranian drones hit three Amazon datacenters in the Gulf, and the world's most important metaphor acquired a street address. On the morning of 1 March 2026, Iranian drones struck three Amazon Web Services datacenters in the United Arab Emirates and Bahrain — by the accounting of analysts quoted in Rest of World's reporting, the first confirmed military attack on a hyperscale cloud provider anywhere. Within hours, the abstraction failed in the most literal way available. Banking apps in the UAE stopped working. Payment and delivery platforms went dark. Snowflake, an enterprise software firm used by thousands of businesses far from the Gulf, reported regional disruptions traced straight back to the AWS outage. Amazon's advice to its customers was the kind of sentence no cloud marketing deck has ever contained: migrate your workloads out of the Middle East. The cloud's founding promise was that place had stopped mattering. Your data was "in the cloud" the way a soul is in heaven — somewhere better, somewhere abstract, somewhere beyond the reach of weather and politics. That promise was always a billing convenience wrapped around a physical fact: your data sits in specific buildings, on specific streets, in specific jurisdictions, cooled by specific water and power systems and guarded by specific states. It took a war to publish the coordinates. !Situation board: war finds the datacenter — three AWS facilities struck, 18 companies named as targets, data rerouted from subsea cables to fiber along Iraqi oil pipelines, the $30bn Stargate campus under threat, and the efficiency-versus-survivability math of 200GW of global capacity with no dedicated international protection regime The soft underbelly of the compute age What makes the Gulf strikes more than a regional incident is why Tehran says the targets were chosen. Iran declared it had attacked the AWS facilities because they supported the "enemy's military and intelligence activities" — an allegation that has not been publicly established, and which Amazon has declined to address — and named 18 companies as "legitimate targets" — Amazon, Google, Microsoft, Nvidia, Palantir, and the UAE's own G42 among them. Tehran has since threatened the $30 billion Stargate campus in Abu Dhabi, built to run OpenAI systems on Nvidia hardware. Strip away the rhetoric and Iran has still pointed at something real. Over the past decade, Western militaries and intelligence services moved much of their computing onto commercial cloud providers. The most sensitive tiers are kept apart — Amazon's Top Secret cloud, for instance, runs on physically isolated infrastructure — but below that level, co-tenancy is the industry norm. One Gulf-based lawyer told Rest of World that, across the industry, civilian enterprise applications routinely sit on the same physical servers as AI systems used for military intelligence and war simulations. Whether that was true of the three buildings Iran struck is not publicly known. The legal exposure is real all the same. The shield that international humanitarian law places over civilian infrastructure can be complicated — and, in certain circumstances, lost — by a procurement decision. A commercial datacenter that makes an effective contribution to military action may become a military objective, even while banks, hospitals and civilian apps continue to depend on it. That does not make every attack on it lawful: proportionality and precautions in attack still apply. But it means governments that intertwine military systems with commercial infrastructure can expose civilian services to risks their users never knowingly accepted. Data flees down the oil corridors The most arresting detail of the whole affair is where the data went. Nearly all Gulf traffic to Europe travels through subsea cables running under the Red Sea and the Strait of Hormuz — both now war-exposed. The working alternative, Rest of World found, is a fiber-optic route that an Iraqi Kurdish telecom spent fifteen years stringing alongside crude-oil pipelines, using the pipelines' existing security perimeters, access roads and maintenance corridors. "Most if not all the hyperscalers" have bought capacity on it. The route is faster than the sea path — roughly 70 milliseconds to Europe against 150 — and the providers are buying it as dark fiber, raw strands they light themselves so that no government or intermediary sits between them and their data. There is a whole essay in the image alone: the twenty-first century's strategic commodity fleeing a war zone along the physical right-of-way built for the twentieth century's. The infrastructure of oil — the corridors, the guards, the politics of transit states — is being reused wholesale, and with it the geography. Iraq, of all places, is becoming a data chokepoint because it is stable enough and because the trenches were already dug. Transit countries once collected rents on barrels; now they will collect rents on packets, and acquire the leverage that comes with them. Everyone updates at once Wars are learning events, and everyone is taking notes. Huawei Cloud waited two weeks after the strikes before posting that "single-region dependency is a thing of the past" — multi-cloud resilience, it suggested, is no longer optional. The pitch is opportunistic and transparent, and it may work anyway, because the underlying claim is true. Gulf states that spent 2025 signing hundred-billion-dollar deals with American providers — partly as alignment, chips and cloud as the currency of the relationship — have just watched American infrastructure become the reason their banks went down. The hedging instinct that governs their oil politics now has a cloud-shaped application. Governments elsewhere are drawing a quieter conclusion: that data localisation, the signature digital policy of the past decade, aims at exactly the wrong target. Requiring data to stay inside national borders concentrates it inside national threat envelopes. The emerging alternative is the "data embassy" — a datacenter on foreign soil that stores a nation's data under the home country's law, as Estonia and Monaco already do in Luxembourg, and as Saudi Arabia's draft AI law now contemplates. Sovereignty, it turns out, may be better served by dispersal than by containment: the state's digital continuity guaranteed precisely by not keeping everything at home. The concept is elegant in theory, thinly supported by treaty in practice, and suddenly urgent. And the engineers are rediscovering an old trade-off. Hyperscale datacenters exist because concentration is efficient; concentration is also what makes a single facility hosting thousands of servers an easy target to find and to hit. Analysts are already sketching the alternative — many small, distributed facilities with redundant copies — which is more resilient and worse in every other respect: costlier, harder to synchronise, less efficient. Efficiency and survivability pull in opposite directions, which soldiers have known about supply depots for centuries. The compute industry is simply the latest logistics enterprise to learn it under fire. The moral for everyone watching The Gulf war will end, one way or another. The precedent will not. Datacenters will now sit far more prominently on the target lists and vulnerability assessments drawn up for future conflicts — which means the risk premium spreads well beyond the Gulf: war-risk insurance on server halls, multi-region redundancy hardening from best practice into something closer to a requirement, costs cascading down to businesses and customers who have never heard of co-tenancy. A Taiwan contingency now includes, on every side's whiteboard, the question of what happens to the buildings where the models live. The deeper shift is conceptual. For two decades the cloud was governed as a market and discussed as a metaphor. It will now be governed as territory — protected like desalination plants, targeted like fuel depots, hedged like pipelines. That was always the truth beneath the branding. The drones didn't change what the cloud is. They changed how much longer everyone could afford to pretend.