National Interest

by Lora Karch

    Critical infrastructure all around the world and in the United States is vulnerable to drone attacks.

    Modern warfare no longer discriminates between military targets and commercial infrastructure—as recent Iranian attacks on data centers in Bahrain and the UAE demonstrate.

    The Islamic Revolutionary Guard Corps (IRGC) quickly took responsibility for the drone and missile attacks in March and April, claiming it plans even more attacks on companies including Microsoft and Apple. Experts predict more targeted attacks on these centers due to the US military’s increased reliance on them. Amazon has also confirmed that the destroyed infrastructure in the Middle East is now “beyond saving.”

    Geopolitical security risks normally tied to governments and their militaries are now expanding to private companies. The United States tried to mitigate the threat of the spread of drone warfare through the Safer Skies Act, which allows trained local state and tribal governments to take their own counter-drone measures and legally respond to threats, but left private companies out of the legislation with virtually no protection.

Physical security is becoming an unprecedented part of corporate risk management in and outside of the United States. Whether through unidentified spy balloons or foreign military drones, critical facilities at home and abroad are becoming increasingly vulnerable to targeting. The law shows congressional recognition of the security problem. However, private companies are still restrained from acting against the threat, which begs the question: If government entities can legally protect themselves from attacks, why shouldn’t the private sector be allowed to do the same for their facilities

    Private owners and operators are naturally more motivated to invest in protection for their companies. The US government can’t assign anti-drone security personnel at every vulnerable facility without draining its own resources. To close the gap, the government can let companies use protective tools while setting reasonable boundaries to prevent foul play, rather than monopolizing defense capabilities.

    Of course, companies shouldn’t have unlimited freedom to shoot down all aerial vehicles they deem dangerous. But banning private defense altogether isn’t the solution either.

    Senator Tom Cotton’s (R-AR) proposed Critical Infrastructure Airspace Defense Act would authorize designated private facilities to defend themselves against credible drone threats—including nuclear plants, power-control centers, and more. If passed, the legislation would expand defensive authority and give federally trained personnel the tools to defend specified infrastructure from unauthorized drones in their areas.

    As war increasingly affects civilians, why shouldn’t their ability to protect themselves grow with it  To prevent misuse, the program can include designated training facilities, certification programs, rules of engagement, post-incident reporting for accountability, and other guardrails.

    The Bahrain and UAE attacks demonstrate the growing pattern of commercial infrastructure becoming collateral damage in regional conflicts. A growing number of American companies operate overseas facilities—often in strategically important regions—and the government cannot guarantee security personnel to defend them. Legally recognized private defense options are logically the next best line of protection.

    If the United States expects private companies to build and maintain infrastructure it relies on—as seen in contracts with Palantir and Amazon—it shouldn’t prevent those companies from investing in reasonable self-protection measures.

    National security isn’t neatly divided between public government targets and private company property. The two are often connected, whether as data centers, power networks, or communication structures. To protect them, the government should treat them as critical infrastructure and work with private owners to build the ability to defend their facilities.