The Underground Cloud

The cloud sounds weightless. Yet artificial intelligence models, government records, financial transactions and communications rely on physical machines housed in identifiable places. The cloud has an address, and that address can be attacked.

Data centers depend on servers, electrical grids, fiber connections, cooling equipment and technicians. As AI and cloud demand grows, these facilities become larger, more power-intensive and more consequential to modern society.

This raises a question that receives far less attention than cybersecurity: if some data centers are becoming critical national infrastructure, should we be doing more to protect the centers themselves?

In August 2026, Reuters reported Ukrainian strikes affecting more than twenty warehouses belonging to Wildberries, a major Russian e-commerce company. Russia has likewise attacked Ukrainian logistics, energy and industrial sites. September reports described strikes affecting Pavlohrad and an agribusiness facility in Dnipro showing that civilian and dual-use infrastructure can become a target during a major war.

The idea of putting data centers underground may sound like a proposal for some distant dystopian future, but the reality is that we are already living in that world. Several projects have already demonstrated that large computing facilities can function inside former mines and other underground industrial spaces.

On Norway’s west coast, Lefdal Mine Data Centers operates inside a former mine. The company describes six underground levels, controlled access, protection from surrounding rock and a cooling system that draws on the nearby fjord. It demonstrates how physical security, scale and energy efficiency can coexist.

The American examples may be even more instructive. Iron Mountain operates KCM-1 near Kansas City, Missouri, approximately 110 feet below ground and only about ten minutes southeast of downtown. The facility shows that underground infrastructure does not have to be isolated from the workforce, highways, airports, utilities and fiber connections of a major metropolitan area. In fact, this proximity is almost necessary for this sort of project to function efficiently.

In western Pennsylvania, Iron Mountain’s WPA-1 facility sits roughly 220 feet underground in a former limestone mine less than an hour north of Pittsburgh. The 330,000-square-foot data center has 15.5 megawatts of power capacity and uses an underground reservoir as part of an efficient cooling system. The surrounding complex has long been used for high-security records and other sensitive assets.

Underground data centers are already a proven concept. The more useful question is whether the United States should make greater use of the model as the strategic importance of computing grows.

Hundreds of feet of rock can provide passive protection difficult to replicate in a conventional building. Underground facilities can also limit access points and reduce the amount of equipment exposed at the surface. Rock is a formidable barrier, although hardly an absolute one as seen in attacks on Iran’s underground nuclear facilities.

The benefits extend beyond deliberate attack. Underground facilities can be naturally protected from tornadoes, hail, severe storms and some temperature extremes. Stable underground temperatures may reduce parts of the cooling burden, depending on the site and system design. Former mines can also provide large volumes of already excavated space without consuming the same amount of surface land as a sprawling data center campus.

There is an economic development argument as well. Many American regions that once supported mining and heavy industry still possess underground industrial spaces, electrical infrastructure, transportation links and communities looking for new economic roles. In the right circumstances, yesterday’s extractive infrastructure could become tomorrow’s digital infrastructure.

Western Pennsylvania illustrates the opportunity that former industrial sites lie near Pittsburgh’s workforce, universities and technology sector. WPA-1 demonstrates the model. Policymakers and industry should assess other well connected, geologically suitable locations rather than assume every disused mine is viable.

Underground does not mean invulnerable. Grid outages, severed fiber, exposed entrances and vulnerable cooling equipment remain serious risks. Mines can also present groundwater, humidity, subsidence, ventilation and fire-safety problems. Some would cost more to rehabilitate than new surface facilities.

With this in mind, most commercial data centers should continue to be located wherever economics, latency, energy availability and customer demand make the most sense. The case for hardening these targets is narrower.

Certain critical computing facilities support government operations, defense related cloud services, financial systems, emergency communications, strategic backups, major artificial intelligence workloads and other functions whose sudden loss could have consequences far beyond an individual company. For that category of infrastructure, physical resilience should carry more weight in design decisions.

An underground facility intended for continuity during a national emergency would still need redundant power, multiple independent communications routes, protected support systems and the ability to continue operating through disruptions outside its walls. The rock is not the entire defense. It is one layer of it.

The United States does not need to bury its entire state apparatus underground, but it does need to recognize that the digital economy ultimately rests on physical infrastructure.

For decades, governments have hardened systems considered essential to national survival. The extraordinary growth of cloud computing and artificial intelligence is creating a new class of infrastructure that may deserve some of the same thinking, not because every data center is a military asset, but because a modern society can become dangerously dependent on concentrated computing capacity.

The lessons learned from the ever expanding battlefield between Ukraine and Russia are making the vulnerability of infrastructure increasingly visible. Long-range precision weapons and inexpensive drones have reduced the protection once provided by distance from the frontlines. At the same time, cyberattacks, sabotage, severe weather and grid failures create non-military reasons to value physically resilient facilities.

Underground data centers are not a universal solution, but they are a proven one. America already has examples beneath Missouri and Pennsylvania. Norway has demonstrated what is possible at an even greater scale inside a mountain. The next step does not require a grand federal program or a nationwide network designed from Washington. It requires a change in how we think about critical computing infrastructure.

As new data centers are built to support AI, government services and the broader digital economy, resilience should become a more explicit part of the calculation. Where suitable underground industrial space exists and where power, fiber, geology and access make sense, the United States should encourage operators responsible for especially consequential workloads to consider going below ground.

The cloud may be digital, but its foundations are not. For the most critical pieces, a few hundred feet of rock may be one of the oldest technologies available for protecting the newest.

Ben Poulin is the founder of Victarra Strategic, an independent publication focused on defense, geopolitics and strategic concepts. He previously served in the U.S. Army and is also the author of several novels. His nonfiction work focuses on European security, military innovation and national resilience.

Reuters, “Ukrainian attacks on Wildberries strike at heart of Russia Inc,” August 7, 2026. https://www.reuters.com/world/ukrainian-attacks-wildberries-strike-heart-russia-inc-2026-08-07/

Reuters, “Russian strikes kill five in Ukraine industrial hub of Pavlohrad,” September 10, 2026. https://www.reuters.com/world/europe/russian-forces-hit-kyiv-petrol-station-injuring-four-2026-09-10/

Iron Mountain, “W. Pennsylvania data center (WPA-1).” https://resources.ironmountain.com/solution-guides/d/data-centers-western-pennsylvania-wpa-1

Iron Mountain, “Kansas City data center.” https://www.ironmountain.com/data-centers/locations/na/kansas-city

Lefdal Mine Data Centers, “Security.” https://www.lefdalmine.com/data-center/security