Physical Security: Siting, Zones & Kinetic/Drone Threats

Treat physical security for an AI data center as a checklist item and you get a fence, a guard, a badge reader, some cameras and a SOC 2 line that says controlled access. That misses what is being protected. A single hall now concentrates billions of dollars of accelerators and, more importantly, model weights, whose theft is a strategic event, not a financial one (the asset taxonomy and adversary tiers are in Chapter 11.1). The sharper reason is that the threat became kinetic.

In March 2026, during the escalation after Operation Epic Fury, one-way attack drones that the IRGC claimed to have launched struck commercial cloud infrastructure in the Gulf. Two AWS facilities in the UAE took direct hits and a Bahrain site took blast damage, with AWS reporting structural damage, disrupted power delivery, and fire-suppression water damage (DefenseScoop, Mar 2026). The damage did not stay local. A second Bahrain availability zone was disrupted in April and the region became unavailable. In a September 2026 status update (reported by Reuters, 16 Sep 2026), AWS said the Bahrain region cannot be restored, and neither can data or other resources held only in UAE zone mec1-az2. AWS said the damage ran across several availability zones, beyond what its regional and multi-AZ services are built to withstand. The IRGC also claimed an April strike on Oracle in Dubai. Dubai authorities said interception debris hit the facade of an Oracle building, a minor incident with no injuries.

The event shows aerial exposure, but it gives no attack probability for another site. For siting, it means civilian compute now sits at the intersection of economic and political pressure, which makes it a target.

The chapter moves outward to inward, then up. Siting comes first, the most irreversible decision and one made before any zone exists. Next comes the concentric-zone model, with access control, biometrics and surveillance placed inside it. Two threats the perimeter handles badly close the chapter: aerial (drones) and kinetic or sabotage attacks on the single points of failure outside the fence. They are followed by the physical-cyber convergence that makes the security system itself an OT attack surface.

The earliest physical-security choice is where the slab goes, and it is made for power and latency reasons (the reordered siting hierarchy is in Chapter 3.1) long before a security engineer is in the room. By the time security is consulted, the standoff distance, the airspace overhead, the distance to a hostile border and the route of the utility tie are fixed in concrete. Standoff, the distance from the public road or fence line to the critical building, is the cheapest blast and small-arms mitigation there is. It is free at scoping time and ruinously expensive to retrofit. How much standoff and controlled perimeter a site needs depends on the threat model, construction, assets and land constraints, down to details like whether the loading dock opens onto a public street.

Siting also sets the threat tier you must design against. A facility in a politically stable interior region mostly defends against opportunistic theft, insider misuse and protest. A facility within drone or missile range of an active or latent conflict (the Gulf, parts of Eastern Europe, contested maritime regions) must design against a kinetic adversary, which changes everything from glazing to dispersal architecture. The 2026 Gulf strikes show the split: the same hyperscaler's facility is a fence-and-badge problem in one region and a war-infrastructure problem in another. Siting pre-selects which of those two buildings you operate, and you cannot move a slab.

Inside the fence, the organizing pattern is concentric zones: nested rings, each crossing requiring stronger authentication and opening access to higher-value assets, provided credential scope, emergency exits, service routes and shared administration do not bypass the next boundary. This is defense-in-depth expressed physically. The number of zones is the design variable. Derive it from the protected assets, the credible access paths and the response time, and use the RAND framework in Chapter 11.1 for the weight-theft threat. A higher target can justify dual control and stronger inner access without prescribing a ring count. Asset, adversary, safety and access-path analysis set the boundaries: push the highest-value assets (weights storage, the OT/control core, the key-management hardware) to the center and make the path to them long, observed and authenticated at every step.

Read the table as a depth budget. Every ring buys detection time and forces the adversary to defeat another distinct control type. The value is in variety, not just count: a badge reader on every door is one control defeated five times, while a badge plus biometric plus a two-person rule plus tamper-evident hardware is four different defeats. The reference table follows that rule: a PIN at the building, a biometric at the hall door, and a separately enrolled biometric plus a second person at the cage, so one cloned badge and one spoofed fingerprint do not open every ring. Zones are cheap to specify at design time and expensive to retrofit, so depth is a density-ramp decision. A hall scoped today for three zones cannot easily grow a weights-bearing fifth zone later without re-planning circulation, doors and the OT room. If there is any chance the facility hosts frontier weights, reserve the innermost-zone footprint now, the way you reserve floor loading and water for a cooling ramp.

The zone model is only as good as the chokepoints that enforce it. Three control families do the work, and each carries a decision with a downstream cost. Access control (badges, PINs and, increasingly, mobile credentials) is the backbone. Its failure modes are tailgating and credential sharing, so the controls that matter are anti-tailgating mantraps, anti-passback (you cannot badge in twice without badging out) and turnstiles rather than swing doors at the high-value boundaries. Biometrics (fingerprint, facial, iris, vein) raise the bar from something you have, a clonable badge, to something you are, which matters because credential theft is the cheap attack. They bring their own decisions: a privacy and data-residency obligation on the biometric template, which is personal data under GDPR and equivalents (data governance in Chapter 10.10, residency and sector overlays in Chapter 11.11); a false-reject rate that throttles legitimate throughput; and a spoofing surface that demands liveness detection.

Surveillance is the third leg, and 2026 changed its economics. AI video analytics turn cameras from a forensic record, useful only after the fact, into a real-time detector: loitering, line-crossing, abandoned-object and crowd analytics that alert before the breach completes. The fork is record-and-review versus detect-and-respond. A passive CCTV estate is cheap and exonerates you in the post-mortem. An analytics-driven estate costs more and generates false positives that someone must staff, but it compresses the detection-to-response time that is the whole point of the concentric model. For a high-value facility the answer is detect-and-respond, because the depth budget you bought in the zone model is wasted if nobody watches the rings in real time.

The perimeter model assumes the threat arrives on the ground. Drones ignore standoff, fence and mantrap and arrive over the top, on the one axis the concentric zones do not cover. The 2026 Gulf strikes are the proof of concept at the nation-state end of the spectrum. The more common risk is cheaper. A commercial FPV quadcopter costs a few hundred dollars and can fly a small charge a few kilometres onto a CDU plant, a transformer yard or a rooftop chiller. It can also just hover over the yard with a camera. The Gulf strikes used fixed-wing one-way attack drones, which fly much farther. Published estimates for a Shahed run from about $20,000 to $80,000 apiece. CSIS used $35,000 in a February 2025 analysis and called it conservatively high, because it judged the low estimates realistic. Either way the cost asymmetry is extreme, with hundreds to tens of thousands of dollars of airframe set against a facility worth hundreds of millions. Either kind goes for what the ground perimeter leaves open: unhardened single points of failure such as cooling, the power tie and fuel.

Law sharply limits the response, though not in the way most operators expect. A private operator may not use mitigation at all, and detection is not a single legal category. The DOJ/FAA/DHS/FCC interagency advisory says the analysis does not turn on active versus passive or detection versus mitigation. It turns on what a given sensor collects and transmits. Passive acoustic and optical sensing is the clean case. A system that captures or uses the radio link between a drone and its controller can implicate the Pen/Trap Statute and the Wiretap Act, and any emitting system, radar included, needs FCC authorization (UAS-detection radar requires a Radiolocation Service license) as well as FAA clearance. Assess each sensor's collection and transmission functions, your own authority and the available exceptions before the purchase order, not after.

Defeating a UAS by jamming, spoofing, capturing or downing it collides with federal statutes (the Wiretap Act, 18 U.S.C. §32 on aircraft sabotage, and FAA airspace rules), and the authority to do so has historically been reserved to a narrow set of federal agencies. The FY2026 NDAA opened the first crack in that wall, creating a statutory path for certified state, local and tribal law enforcement to deploy counter-UAS after DOJ training. The DOJ/DHS rule that implements it took effect on 1 July 2026. Under that rule a certified agency may not hand mitigation to a contractor, even when it is sold as a turnkey or managed counter-UAS service. An operator therefore cannot pay a vendor to carry out the mitigation, meaning the drone takedown, on the police's behalf. Vendors can still sell, install and maintain the equipment. Operators can request protection from a certified local agency. Those requests go into a report to Congress on whether critical-infrastructure owners should get counter-UAS authority. A private data center operator still has no legal authority to take a drone down.

One lever may come within the operator's reach. The FAA's Section 2209 proposal (NPRM, May 2026, not yet final) would let a fixed critical-infrastructure site apply for a drone flight restriction over its property, generally up to 400 feet, if it shows its own protective measures and a regional or national impact. The restriction makes an overflight an enforceable violation rather than just a sighting, but it authorizes no mitigation. Prepare the application evidence (asset criticality, existing protection) now. A bill to give facility operators mitigation authority, the Critical Infrastructure Airspace Defense Act (introduced April 2026), has not been enacted.

For design, your counter-UAS program is a detect-classify-alert-and-coordinate program, not a kinetic one. You build airspace awareness and a fast line to the agencies who can act; you do not build a jammer you are not allowed to switch on.

With mitigation mostly off the table for the operator, the engineering response shifts from stopping the drone to surviving the hit. That makes it a resilience decision, not a guard-force one. Two levers dominate. Hardening covers the exposed single points of failure: protective screens or cages over rooftop chillers and CDUs, blast-resistant transformer enclosures, and structural separation so a rooftop strike does not propagate into the white space. Dispersal and redundancy covers the rest. AWS's September status update shows why: the Gulf damage went past what its regional and multi-AZ services are built to withstand. Reuters reported that most customers had moved their workloads after AWS recommended it following the March damage, and that AWS helped the rest rebuild elsewhere from backups where they existed. The durable defense is architectural. Spread critical capacity across regions, not only availability zones, and put power, cooling and network paths far enough apart that neither one strike nor a campaign against one metro can take the workload down. The reliability chapters apply the same logic to random failures (goodput over availability in Chapter 12.2). Here it faces a deliberate adversary, and the cheapest way to beat a cheap drone is to make sure hitting any one target does not matter.

The most under-defended attack surface is not the data hall. It is the cluster of overlooked single points of failure outside the building and often outside the fence: the substation and the utility tie, the on-site generators and their fuel, the behind-the-meter gas connection, the fiber entrance vaults and the make-up water supply. A saboteur does not need to reach a rack. An angle grinder on a substation, a rifle round through a transformer radiator, or a few minutes in the fiber vault strands the entire load.

The grid data makes the prize concrete. In 2024 a lightning-arrester failure on a Virginia 230 kV line, followed by staggered auto-reclosing, produced six faults in 82 seconds. Roughly 1,500 MW of exclusively data-center load left the grid on the customer side, with about 1,260 MW staying off the system for hours (NERC). That was demand leaving as the data centers transferred to backup power. They rode through, and the scale came from 60 load points at 25 substations sharing one transmission corridor. The 2024 event was not the largest. On 22 July 2026 one normally cleared 230 kV fault near Ashburn sent about 3.8 GW of data-center load off the grid as sites transferred to backup, roughly 2.5 times the 2024 scale (PJM; Chapter 4.10). That took one ordinary fault rather than a six-fault sequence, so a saboteur who forces a single fault on the right line could move load on the same scale.

Sabotage that destroys the tie is another matter. Once the tie is gone, the site keeps running only while its generators hold up and their fuel lasts. A damaged utility tie or large substation transformer may also need new equipment, repairs, studies and re-energization, and how long that takes depends on the asset (Chapter 4.3). The substation is a single point of failure that cannot be restored on the timescale of a rack swap.

The decision is how far to extend the concentric-zone model and the hardening budget to these external assets. The cheap, often-skipped controls are: pulling the substation and fuel inside the fenced, monitored Zone 2 instead of leaving them on a public easement; ballistic-rated or screened transformer enclosures; diverse, physically separated fiber entrances, so cutting one vault does not isolate the site; and intrusion detection on the yard, not just the building. Skip them and you have built five concentric zones around the racks and left the thing that powers them by the roadside. Do not assume the grid's own rules protect it. Under NERC's CIP-014, a Transmission Owner must assess its qualifying transmission substations, but the physical-protection duties fall only on the ones it judges critical to the wider grid. The station feeding a campus is often not among them, and its protection is then whatever you and the utility agree (Chapter 4.3). The physics of these failure modes, the synchronized load step and the thermal runaway from a disabled CDU, is dual-use: the same events appear as random faults in the reliability chapters and as deliberate weapons in the OT-attack chapter. Transient physics is in Chapter 4.5; the destructive-attack treatment of OT systems is in Chapter 11.10.

The final decision is the one most likely to be missed, because it inverts the chapter: the physical-security system is itself a cyber attack surface. Access-control panels, biometric readers, the CCTV/VMS estate and, most dangerously, the building-management system (BMS) and electrical-power-management system (EPMS) that security teams often co-own are all networked devices running embedded firmware, frequently on flat networks with default credentials and vendor remote-access tunnels. They are operational technology and must be treated as OT: segmented off the corporate and production networks, patched, monitored and access-controlled like any other control plane. The convergence cuts both ways. An attacker who compromises access control can unlock the doors the concentric model relies on. An attacker who reaches the BMS/EPMS can manipulate cooling and power directly, turning a cyber intrusion into a physical, destructive event (the forced load step, the disabled CDU, the BESS runaway).

The fork is organizational as much as technical: who owns the security and BMS network, and is it in the OT-segmentation program or orphaned as facilities IT? The 2026 best practice, which industry guidance now emphasizes, is a single converged security function where physical and cyber are not separate fiefdoms. Cameras and door controllers sit behind the same microsegmentation as any other OT, and the BMS/EPMS sits inside the OT zones of the Purdue model, not on a flat facilities VLAN. The cost of the un-converged organization is the seam: a physical team that owns the cameras but not their network security, and a cyber team that does not know the door controllers exist, leave exactly the gap a converged adversary walks through. Network segmentation and the zero-trust treatment of these planes are in Chapter 11.7. The destructive OT-attack physics, and the safety-instrumented-system independence that a compromised control plane cannot override, are in Chapter 11.10. The cooling-controls plane is in Chapter 5.12.

The same physical-security mistakes recur, each from reasoning about one layer in isolation:

• Hardening the core, ignoring the tie. A flawless five-zone interior wrapped around a substation, fuel farm and fiber vault sitting un-fenced on a public easement. The adversary strands hundreds of megawatts without touching a rack, and restoration still needs a compatible transformer, transport, permits, installation and energization.
• Buying a counter-UAS weapon you cannot legally fire. Procuring jammers or kinetic interceptors that a private US operator has no authority to deploy, instead of spending the budget on detection, law-enforcement coordination, rooftop hardening and dispersal. Before you buy even those, confirm local law allows them and test that they work at your site.
• Orphaning the security network. Treating cameras, door controllers and the BMS/EPMS as facilities appliances outside the OT-segmentation program, leaving default credentials and vendor tunnels as the seam between the physical and cyber teams that a converged adversary walks through.
• Designing zones for the wrong asset class. Scoping the access boundaries for an enterprise inference hall contractually barred from frontier weights, then admitting frontier inference without reassessing access paths, response time and credential scope for its weights and adversary class. It is the physical-security version of the density-ramp trap: the irreversible substrate (circulation, doors, OT room) was never reserved.

Fund barriers, response and alternate-service capacity against the chosen adversary's access paths, including the substation, fuel and fiber outside the hall. Extra zones consume space and slow service, but an omitted path can defeat every interior door. Reserve irreversible circulation and protection provisions before admitting an asset class that needs them.