From Sasovo to Milan, data centers are targets and battlegrounds

On October 8, 2026, a drone set fire to a warehouse in Sasovo, a town in Russia’s Ryazan region a few hundred kilometers from Moscow. Inside that warehouse was one of Yandex’s data centers, the company the international press calls the Russian Google. The detail that changes the perspective was reconstructed by The Record. The facility shares the site with Sasta, a machine tool factory sanctioned by the United Kingdom and its Western partners because it works for the Russian defense industry. Servers and lathes inside the same fence: dual use, usually explained with charts and treatises, here sits within a single address. For the Italian ecosystem of founders, operators, and investors, the discussion about data centers as strategic infrastructure no longer belongs only to geopolitics think tanks. The lesson arrives straight into the municipal councils of the Milan area.

Two scenes, one single object: the data center from Sasovo to Lacchiarella

In July 2026, three months before Sasovo, about 150 people took to the streets in Lacchiarella, in the southern Milan area, against the Apto campus. The investment is worth roughly 3 billion euros over 228,000 square meters. The power capacity reaches up to 300 megawatts. The reason for the protest, as Open reported, was the consumption of land and resources. Two very distant scenes, speaking about the same object.

Until 2026 they belonged to two separate discussions. The one about data centers as cumbersome next-door neighbors, held in town halls. The one about data centers as war infrastructure, held in think tanks. The year 2026 brought them together, and the dispute over where to build can no longer ignore the second one.

Land, water, electricity: the Italian push and the decree

The sector’s numbers in Italy are growing fast. The Data Center Observatory of the Polytechnic University of Milan, cited by Open, provided the 2025 figures. Italy reached 609 megawatts of installed computing power, a 19% increase in one year. Milan alone accounts for 68% of it. Grid connection requests filed with Terna by August 31, 2026 exceeded 100 gigawatts. The Milan area alone accounts for 47.3, with 296 applications, according to data reported by Milano Finanza. No one in the industry believes all those projects will actually be built. Often the high-voltage request only serves to drive up the value of the land, as Cristiana Mattioli of the Polytechnic explains.

Around these projects a geography of oppositions has emerged. In Bollate, Legambiente and residents are contesting a project on agricultural land between the Parco Nord and the Parco delle Groane, with an appeal to the regional administrative court. In Magenta, a petition against the data center in the former Novaceta area has gathered more than 1,200 signatures, as Il Foglio reports. In Bornasco, in the Pavia area, the “Sentinelle del territorio” committee opposes the new facilities. About fifty mayors of the southern Milan area have asked the Region to postpone the law. That law pushes data centers toward already-built or disused areas. There are three arguments, and they are serious: disappearing farmland, water for cooling, and electricity costs that someone else will pay.

It is not only an Italian story. The Data Center Watch census already counted 64 billion dollars in projects blocked or slowed down by local opposition in the United States in 2025. The census points out that in most cases these are delays rather than cancellations.

The Italian government chose the opposite path: the accelerator. Decree-Law 21 of February 20, 2026 is the so-called “bills decree.” Article 8 introduces a single authorization that should be completed within ten months. For projects of national strategic interest, responsibility passes to an extraordinary commissioner. His authorization counts as a declaration of public utility, non-deferrability and urgency, as lawyer Donatella Di Gregorio reconstructs on Agenda Digitale. Environment Minister Gilberto Pichetto Fratin has called data centers “a strategic necessity.” Lombardy regional councillor Massimo Sertori described the appointment of a commissioner as a “very concrete hypothesis,” even though he does not want it.

2026 adds a new entry to the bill: the target

In early March 2026, in the war between the United States, Israel, and Iran, Iranian drones hit three Amazon data centers between the Emirates and Bahrain. The UNIDIR study Clouds of war was published on April 23, 2026. UNIDIR is the United Nations institute for disarmament research. According to the study, it was the first documented case in which commercial data centers were deliberately targeted in a military operation. At the end of March, the Revolutionary Guards published a list of 18 American tech companies indicated as targets, from Nvidia to Oracle to IBM. On September 15, 2026, Amazon notified customers that data hosted solely in its Bahrain region and in one of the Emirates zones could no longer be recovered.

Then the same logic arrived in Europe. Since late September 2026, Russia has been striking Ukrainian data centers. It justifies the attacks with the claim that those servers process intelligence data for Kyiv’s armed forces, as documented by Meduza. Ukraine responded between October 8 and 11, 2026 by hitting three Yandex data centers: the one in Sasovo, in the Ryazan region, and those in the Kaluga and Vladimir regions. President Volodymyr Zelensky said that Kyiv always responds “in mirror,” according to Al Jazeera.

Here lies the legal knot. Under the law of armed conflict, a civilian building becomes a lawful target only if it genuinely contributes to military operations. But a data center is dual use by nature: in the same warehouses run bank accounts, medical records and, at times, military programs. Legal scholars Luke Moffett and Alannah Travers, of Queen’s University Belfast, say it bluntly on Opinio Juris:

The dual-use nature “can render any attack” against data centers “indiscriminate,” because a drone does not separate the army’s servers from the bank’s.

Sasovo, with the data center in the yard of a sanctioned factory, is the textbook case no professor would have dared invent.

Concentration and efficiency: the tap has an address

Why hit data centers, among everything else that can be hit? The most useful answer comes from the geopolitics of the economy. Henry Farrell and Abraham Newman published the essay Weaponized Interdependence in International Security in 2019. According to them, global networks are not flat: they have hubs through which most flows pass. Whoever has power over those hubs can look inside them or squeeze them, shutting off the tap for those who depend on them. A data center is a hub in this sense: in a single building pass the services of thousands of companies and, through them, the data of their customers. The year 2026 showed that over such a hub the authority can also be that of someone with a drone, and that when the hub is a building, the one who strikes it is the one who closes the tap.

More and more hubs like these are being built, because concentration is the reason a data center exists. More servers in the same place mean more efficient cooling, faster connections, lower costs. Efficiency and bottleneck are the same thing seen from two sides. Peacetime had already shown it. In 2017 a maintenance error in a single Amazon region brought a long list of websites to their knees. In November 2025 an oversized file at Cloudflare did the same to a slice of the internet.

In Bahrain, Amazon had done things by the book, with three separate zones designed to withstand the failure of a building. As the company itself wrote to customers, the damage hit several zones at once, beyond the design limit: the redundancy designed for failure did not hold up against the attack. Then there are those who cannot even distribute their loads: as The Register notes, sanctions limit the use of foreign clouds and local Russian providers are few. So the textbook advice to spread data across distant zones becomes hard to follow. The difference between being exposed to a failure and having no alternatives also applies to an Italian company or public body: every time a data sovereignty rule or the lower price of the nearest region pushes toward keeping everything in one place, you are depriving yourself of the alternative.

The word “strategic” cuts in two: securitization and the future

No one claims that a warehouse in Lacchiarella is a target tomorrow morning: Italy is not at war with anyone. But a data center is built to last decades. Whoever decides where to place it and how big to make it also decides the geography of risk for the next twenty years. The country hosts the cloud regions of some of the very same American companies the Revolutionary Guards have put on their list.

Back to the key word. In Italy, “strategic” has so far served to build faster. A facility declared of national strategic interest goes to the commissioner and leaves the municipal councils of Bornasco or Magenta. It enters a procedure where local committees count for much less. The Copenhagen School has a name for this move: securitization. It was formulated by Ole Wæver in 1995 and developed by Barry Buzan and Jaap de Wilde in Security: A New Framework for Analysis (1998). It is the process by which an issue is presented as a security matter and removed from ordinary politics. Their point is that more security does not automatically mean better: every issue that becomes a “security” matter takes something away from democratic deliberation.

The elephant in the room, the one kept at a constant temperature, is that the same word that speeds up the construction site draws the red circle on the map of whoever attacks. A strategic infrastructure in peacetime is a work to be authorized quickly. In wartime it is what the Revolutionary Guards put on a list. It is also what the Russian Ministry of Defense says it strikes because it would be working for the enemy army. The reason a facility deserves a commissioner, namely, that it concentrates so much that one cannot do without it, is the same reason it is worth hitting.

The answers are up for debate. Il Post, in a long piece on May 3, 2026, lined up distributed networks of many smaller data centers. It also addressed the separation between civilian and military use, the copies of a state’s data kept abroad, and bunkers. Mariarosaria Taddeo, who works on the ethics of digital technologies at Oxford, warns that distributed networks expose more civilians. Alessandro Aresu of Limes observes that smaller, distributed sites could gain ground precisely where local communities resist large facilities. He doubts, however, that on their own they can satisfy the computing hunger of artificial intelligence. This is the most interesting aspect of the story: where local resistance works, less gigantic and more scattered facilities emerge, exactly what an officer would want, so that a single strike does not switch everything off.

The bunker, by the way, already exists in Italy. It is called Intacture and lies under a hundred meters of rock in an active dolomite mine in Val di Non. It costs about 50 million euros, of which 18.4 come from the National Recovery and Resilience Plan. It hosts the supercomputer of the University of Trento, as StartupItalia reported. It was born to save on cooling, thanks to the mountain’s natural 12 degrees. It turns out to be also the most serious answer to the question of how to protect a data center from an attack. Andrea Tironi, on Agenda Digitale as early as March 2026, had written that Europe has regulated cybersecurity extensively and the “war-security” of infrastructure far less. For a founder or an investor, the picture from now on adds a question to the due diligence on cloud infrastructure. Alongside land, water, and electricity: where is the facility, how concentrated is it, and what runs inside it.

Sources:

• open.online
• Data Center Watch | datacenterwatch.org
• developers.cloudflare.com
• Data center, il nuovo fronte della guerra globale. E se il prossimo… | startupitalia.eu