Britain's data centres are becoming strategic national assets. But are we doing enough to protect them?

The reported decision by the US military to move aircraft away from RAF Mildenhall in Suffolk following a perceived security threat linked to Iran should serve as a wake-up call for anyone responsible for protecting Britain's critical infrastructure.

At least ten US refuelling tankers and several Osprey aircraft were moved from the base on Monday, with the tankers dispersed to locations including Germany, Spain and Scotland. The precise nature of the reported threat remains unclear, although the developments follow an earlier withdrawal of American bombers from RAF Fairford in Gloucestershire following a suspected Iran-linked security incident.

These events illustrate how seriously potential threats to strategically important infrastructure are now being treated, among which should be included Britain's rapidly expanding network of data centres.

The Government's ambition to establish 6GW of AI data-centre capacity in Britain by 2030 is not simply about attracting investment, creating jobs or establishing the UK as a global technology leader. It is fundamentally about national security, economic sovereignty and Britain's ability to control and protect the computing capability on which its future will depend.

Yet while considerable attention is rightly being paid to cyber security, power resilience and technological capability, I believe we are overlooking a fundamental question: are we doing enough to protect these facilities from physical threats?

Data centres are now part of Britain's national security infrastructure

There is a tendency to think of data centres as commercial facilities, albeit very large and technologically sophisticated ones.

That perception is increasingly outdated.

Modern data centres provide the computing power and infrastructure supporting financial services, government operations, healthcare, communications, business supply chains and, increasingly, artificial intelligence applications with national security and defence implications.

They are becoming an essential part of the infrastructure that enables a modern state to function.

The Government recognises this. Its recently published Data Centre Covenant explicitly identifies the need for secure domestic computing capacity to support the NHS, defence and other critical services. It also acknowledges that Britain cannot afford to become dependent on infrastructure located overseas.

This is the essence of digital sovereignty: having the domestic infrastructure, capability and control needed to protect Britain's national interests and maintain essential services, even when international relationships or geopolitical circumstances change.

And that brings a very different dimension to the security debate.

If data centres are supporting Britain's sovereign AI ambitions, government systems and defence-related capabilities, they are no longer simply protecting commercial information and customer data. They are protecting assets that have a direct bearing on national resilience and security.

That makes them strategically significant infrastructure.

Why a hostile state might target a data centre

We need to consider this from the perspective of a hostile state.

An adversary does not necessarily need to attack a military installation, steal classified information or destroy physical assets to achieve a strategic objective.

Disrupting the infrastructure on which a country's economy, public services and defence capabilities increasingly depend could be equally damaging, if not more so.

A sustained interruption to a major data centre could affect government operations, financial transactions, communications, healthcare systems and businesses across multiple sectors. Where defence-related services or sensitive government functions depend on that infrastructure, the consequences could extend into national security.

The objective might be to disrupt, undermine confidence, create economic instability, test the UK's response or divert resources at a critical moment.

It could also form part of a wider campaign of espionage, sabotage, intimidation, hybrid warfare, or incursions by proxy actors designed to exploit vulnerabilities without necessarily triggering a conventional military response.

From an adversary's perspective, the attraction is obvious. Rather than attacking multiple organisations individually, disrupting a shared infrastructure provider could potentially affect many of them simultaneously.

This is why data centres are likely to become attractive strategic targets for hostile, state-sponsored activity.

The industry needs to recognise that its risk profile has changed, and that makes physical security an increasingly high priority. 

But it is not the only threat.

The risk of community opposition

The rapid expansion of the data-centre sector is also creating a significant challenge for developers and operators: winning the confidence of the communities in which they want to build.

The proposed AI data campus near Great Torrington in North Devon is a clear example. Plans for a 1.5GW facility covering a substantial area of countryside have prompted strong local opposition.

Campaigners have raised concerns about the impact on the landscape, farmland, water resources and energy supply, as well as the way proposals have been discussed with the community. A national petition calling for a pause to data-centre and battery-storage developments outside designated AI growth zones attracted 30,000 signatures, according to The Guardian.

These are legitimate issues. People have every right to question developments that could have a significant impact on their local environment and infrastructure. Peaceful protest and public scrutiny are fundamental parts of our democracy.

But operators must also recognise the potential for tensions around major developments to escalate.

They need to be prepared to manage demonstrations, protect staff and contractors, maintain safe access and keep essential operations running.

Crucially, they must distinguish between lawful protest and deliberate disruption, trespass or attempts to damage infrastructure. These are not the same thing, and security arrangements should reflect that distinction.

There is also the risk of a more serious threat from individuals or groups acting with hostile intent, including those directed or supported by foreign states.

A demonstration outside a site is visible. Hostile reconnaissance, attempts to establish access credentials or the deliberate testing of perimeter security during protests may be much less obvious.

This is precisely why physical security needs to be intelligent, proactive and properly resourced to respond proportionately and appropriately.

The financial consequences of getting it wrong

Damage to a perimeter, access systems or critical plant could cost tens of thousands of pounds to repair. But these would pale into insignificance compared the financial impact of operational disruption.

Research from the Cyber Monitoring Centre and Parametrix has estimated that a 24-hour outage affecting Microsoft's Azure UK South region could result in £352 million in direct economic losses.

That is a modelled estimate rather than a prediction of what any individual incident would cost. Nevertheless, it demonstrates the scale of economic dependency on digital infrastructure.

And that is before considering the potential consequences for customers, public services, defence-related operations, supply chains and the reputation of an operator.

The risk is not simply that a building or its equipment might be damaged. It is that the failure of one strategically important facility could have a cascading impact across multiple organisations and sectors.

The more dependent Britain becomes on domestic computing capacity, the greater the importance of ensuring that capacity remains available, secure and resilient.

A security presence is not the same as a security strategy

Putting an officer at a reception desk or entrance is not, in itself, a security strategy.

Operators need to understand exactly who is entering their site, why they are there, where they are permitted to go and what happens when something does not look right.

For a data-centre environment, that means robust identity verification and access control, 24-hour monitored perimeter patrols, appropriate visitor and contractor vetting, properly managed gatehouse and control-room operations, restricted-zone controls and clear incident-response procedures.

It also means understanding the site itself.

The security team on the ground needs to know what normal activity looks like. Which contractors are expected? Which vehicles should be on site? What constitutes an unusual pattern of activity? Who has authority to access critical plant rooms? What happens when somebody attempts to enter a restricted area without the correct credentials?

These may sound like straightforward questions. But they are precisely the details that can determine whether a potential security incident is identified early or allowed to develop.

Technology has an important role to play. Modern CCTV, perimeter detection and access-control systems can provide invaluable visibility and help identify suspicious activity.

But CCTV is not a security strategy on its own. It cannot challenge an individual, question a contractor or make a judgement about an unfolding situation.

That requires trained people.

The strongest approach combines technology with experienced, SIA-licensed security professionals who understand the environment they are protecting and have the training, authority and procedures to respond appropriately.

Physical protection must be part of Britain's sovereign security strategy

At UK Protection, our approach to data-centre security combines appropriately trained and security-cleared SIA officers with access control, monitored patrols, gatehouse and control-room operations, critical-area monitoring and incident response.

It is about delivering protection tailored to the individual facility, its operational requirements and its risk profile.

That is a world away from simply putting a man in a security jacket at the entrance and assuming the job is done.

As Britain expands its data-centre capacity and seeks to establish greater control over its own AI and computing infrastructure, operators need to ask themselves some difficult questions.

Where are our physical vulnerabilities? Which assets are most critical to maintaining operations? How do we identify hostile reconnaissance? How quickly would we detect a perimeter breach? What happens if individuals attempt to gain unauthorised access? And do our security officers have the training, intelligence and procedures to respond effectively?

These questions need to be addressed before an incident occurs, not afterwards.

The Government's ambition to build 6GW of AI data-centre capacity by 2030 is to be applauded. Developing sovereign computing capability is vital to Britain's economic resilience, technological independence and national security.

But there is little value in investing billions in infrastructure that is strategically essential if we do not protect it properly.

Cyber security, power resilience and physical protection are not separate conversations. They are all part of the same responsibility.

Because the real test of a data centre is not simply how much computing power it can deliver.

It is whether Britain can rely on it when that capability is most needed – and whether it can keep delivering when somebody deliberately tries to take it away.