La Nube en Guerra: Cuando los Servidores Son el Objetivo

The history here is genuinely fascinating, and it kind of reframes what happened this week.

Do you remember Stuxnet?

Claro.

Of course.

Stuxnet fue un virus informático muy sofisticado.

Stuxnet was a very sophisticated computer virus.

Estados Unidos e Israel lo crearon, según los expertos, para atacar las centrifugadoras nucleares de Irán.

The United States and Israel created it, according to experts, to attack Iran's nuclear centrifuges.

Esto pasó alrededor de 2010.

This was around 2010.

Fue el primer ataque cibernético importante contra infraestructura física.

It was the first major cyber attack against physical infrastructure.

Right, so there's a direct line here.

The country that was on the receiving end of history's most sophisticated cyberattack has been studying that playbook for fifteen years.

Iran didn't forget Stuxnet.

They built a cyber warfare capability partly in response to it.

And now they're using physical strikes on the digital infrastructure of their adversaries.

Sí, y es interesante porque ahora el ataque es diferente.

Yes, and the attack is different now.

Stuxnet fue invisible, fue digital.

Stuxnet was invisible, digital.

Pero este ataque en Baréin fue físico.

But this attack in Bahrain was physical.

Un misil real contra un edificio real.

A real missile against a real building.

La diferencia es importante porque es más fácil ver quién lo hizo.

The difference matters because it's easier to see who did it.

Which is a deliberate choice, I think.

This was a message, not just a tactic.

Iran wanted the world to see that cloud infrastructure is not safe behind the Gulf's air defenses.

That's a signal directed at Amazon, at Oracle, at Google, at Microsoft, at every tech company that has bet big on the Gulf.

Bueno, y estas empresas invirtieron mucho dinero en la región.

And these companies invested enormous amounts of money in the region.

Amazon, Microsoft, Google, todas tienen centros de datos en los Emiratos, en Arabia Saudí, en Baréin.

Amazon, Microsoft, Google, they all have data centers in the UAE, Saudi Arabia, Bahrain.

Es una inversión de miles de millones de dólares.

Billions of dollars.

Y ahora esa inversión tiene un riesgo que antes no existía.

And now that investment carries a risk that didn't exist before.

Here's what gets me about the scale of this.

AWS opened its Bahrain region in 2019 and it was described as a historic moment for cloud adoption in the Middle East.

Within five years, that same infrastructure is a wartime target.

The speed of that transition is kind of dizzying.

Mira, cuando los países del Golfo empezaron a usar la nube, pensaban principalmente en la eficiencia y en el dinero.

When the Gulf countries started using the cloud, they were thinking about efficiency and money.

Era más barato y más rápido.

It was cheaper and faster.

Nadie pensó seriamente en este escenario: un conflicto militar que convierte los servidores en objetivos.

Nobody seriously thought about this scenario: a military conflict that turns servers into targets.

So what does AWS actually do in a situation like this?

I mean, they have redundancy built in.

That's the whole architecture of cloud computing.

If one data center goes down, traffic reroutes.

But that only works if the attack is isolated.

If you're taking out multiple nodes simultaneously, that calculus changes.

Exacto.

Amazon has availability zones, basically separate data centers within the same region.

Amazon tiene zonas de disponibilidad, que son básicamente centros de datos separados en la misma región.

If one fails, the others continue.

Si uno falla, los otros continúan.

But if the attack is large, or if they hit the broader network infrastructure, the system faces serious problems.

Pero si el ataque es grande, o si atacan la infraestructura de red en general, el sistema tiene problemas serios.

I want to ask you something from a European perspective, because Spain has been navigating this question too.

How much of your critical national infrastructure should you hand to an American company?

There's been a real tension in Europe around data sovereignty.

And this attack just made that argument a lot louder.

La verdad es que este debate en Europa es muy serio.

This debate in Europe is very serious.

En España, en Francia, en Alemania, hay políticos que dicen: no podemos depender de Amazon o de Microsoft para guardar los datos de los ciudadanos.

In Spain, France, Germany, there are politicians who say: we can't depend on Amazon or Microsoft to store citizens' data.

Necesitamos nuestra propia infraestructura.

We need our own infrastructure.

Y tienen razón, en parte.

And they're partly right.

In part, you say.

What's the other part?

Es que construir tu propia infraestructura de nube es muy caro y muy difícil.

Building your own cloud infrastructure is very expensive and very difficult.

Europa tiene el proyecto Gaia-X, que es una iniciativa para crear una nube europea.

Europe has the Gaia-X project, an initiative for a European cloud.

Pero avanza lentamente y Amazon y Microsoft son mucho más grandes y más rápidas.

But it moves slowly, and Amazon and Microsoft are much bigger and faster.

Es una competición muy difícil.

It's a very hard competition.

So the Gulf states are in an even more difficult position.

They don't have a Gaia-X.

Saudi Arabia has been building its own sovereign cloud capacity, but it's early days.

The UAE has some local providers.

But for the scale they need, they're dependent on the American giants.

And now those giants are targets.

Bueno, y hay otro actor importante aquí: China.

And there's another important player here: China.

Alibaba Cloud y Huawei tienen operaciones en la región.

Alibaba Cloud and Huawei have operations in the region.

Y ahora los países del Golfo pueden decir: quizás necesitamos diversificar.

And now Gulf countries can say: maybe we need to diversify.

No solo Amazon, no solo Microsoft.

Not just Amazon, not just Microsoft.

Quizás también proveedores chinos o locales.

Maybe Chinese or local providers too.

Which opens up a whole other geopolitical headache.

Because the Americans will have something to say about Gulf countries moving their sensitive data onto Chinese infrastructure.

We've seen that fight play out with Huawei and 5G.

This would be the data center version of that battle.

Sí, claro.

Yes.

Y los países del Golfo están en una posición complicada.

And the Gulf countries are in a complicated position.

Necesitan la tecnología americana.

They need American technology.

Necesitan el dinero americano.

They need American money.

Pero también tienen relaciones económicas muy importantes con China.

But they also have very important economic relationships with China.

Es un equilibrio muy delicado.

It's a very delicate balance.

Let's talk about what this means for ordinary people.

Because I don't want to get so deep into the geopolitics that we lose sight of the human dimension.

If a hospital in Dubai or Bahrain is running patient records on cloud infrastructure, and that infrastructure is hit, that is a patient safety issue.

That's not abstract.

Tienes razón y este es un punto muy importante.

You're right and this is a very important point.

En los Emiratos, muchos hospitales y clínicas usan sistemas digitales para todo: los historiales de los pacientes, los medicamentos, los resultados de los análisis.

In the UAE, many hospitals and clinics use digital systems for everything: patient records, medications, test results.

Si el sistema no funciona, los médicos no pueden acceder a la información que necesitan.

If the system doesn't work, doctors can't access the information they need.

And there's a question of international humanitarian law here that I find genuinely interesting.

We have laws about attacking hospitals.

We have laws about attacking civilian infrastructure.

Is a data center that hosts hospital records a civilian target?

Is attacking it a war crime?

I don't think the law has caught up with the technology.

A ver, las leyes de la guerra son muy antiguas.

The laws of war are very old.

Las Convenciones de Ginebra pensaban en hospitales físicos, en ciudades, en puentes.

The Geneva Conventions thought about physical hospitals, cities, bridges.

No pensaban en servidores.

They didn't think about servers.

Ahora necesitamos nuevas reglas para el mundo digital.

We need new rules for the digital world.

Pero los países no se ponen de acuerdo fácilmente sobre estas cosas.

But countries don't easily agree on these things.

The Tallinn Manual tried to address some of this.

It's a NATO-commissioned document that applies existing international law to cyber operations.

But it's not binding, and it was written before cloud infrastructure at this scale existed.

It feels like trying to regulate air travel with maritime law.

Mira, hay otro problema.

There's another problem.

Un centro de datos de Amazon tiene clientes de muchos países diferentes.

An Amazon data center has clients from many different countries.

Si Irán ataca ese centro, no ataca solo a los Emiratos o a Arabia Saudí.

If Iran attacks it, they're not just attacking the UAE or Saudi Arabia.

Ataca a empresas de Europa, de Asia, de América.

They're attacking companies from Europe, Asia, the Americas.

¿Quién tiene el derecho de responder?

Who has the right to respond?

Es una situación muy complicada.

It's a very complicated situation.

No, you're absolutely right about that.

It's almost like attacking a port.

When you attack a port, you're not just attacking the country where the port is located.

You're attacking every ship from every nation that uses that port.

And we have long-established international norms about that.

We don't have equivalent norms for data centers.

Y las empresas tecnológicas tampoco saben bien qué hacer.

And tech companies don't know what to do either.

Amazon no es un gobierno.

Amazon isn't a government.

No tiene un ejército.

It doesn't have an army.

No puede defender físicamente sus edificios.

It can't physically defend its buildings.

Depende de las defensas del país donde está el edificio.

It depends on the host country's defenses.

En Baréin, eso significa depender del ejército de Baréin y de la ayuda americana.

In Bahrain, that means depending on Bahrain's military and American support.

Which brings us, in a slightly circular way, back to the question of location.

Where you put your data center is now a geopolitical and military decision, not just a business one.

Real estate due diligence now has to include: could this building be targeted in a regional war?

That is a genuinely new variable.

La verdad es que esto va a cambiar los planes de las grandes empresas tecnológicas.

This is going to change the plans of the big tech companies.

Antes, las empresas elegían donde poner sus servidores pensando en la velocidad de internet, en los impuestos y en la disponibilidad de electricidad.

Before, they chose where to put their servers based on internet speed, taxes, and electricity.

Ahora tienen que pensar también en la seguridad militar.

Now they have to think about military security too.

El mundo cambió.

The world changed.

I want to zoom out for a final thought.

Because I think what happened this week is genuinely historic, even if most people missed it.

For most of human history, the critical infrastructure of war was physical: roads, bridges, ports, railways.

Then communications became critical: telegraph lines, radio towers.

Now it's data.

And for the first time this week, we saw a nation-state physically bomb the data infrastructure of its enemies during an active conventional war.

Sí, y creo que en el futuro los historiadores van a recordar este momento.

Yes, and I think historians in the future will remember this moment.

No el misil en el puente de Teherán, no los ataques en los aeropuertos.

Not the missile on the Tehran bridge, not the airport attacks.

Sino este: el día que los servidores de Amazon se convirtieron en un objetivo militar.

But this one: the day Amazon servers became a military target.

Porque esto cambia la naturaleza de los conflictos modernos para siempre.

Because this changes the nature of modern conflict forever.

And on that suitably unsettling note, we'll leave it there for today.

The cloud is real.

It's physical.

And this week it became a battlefield.

Thanks for listening to Twilingua, and we'll see you next time.

Hasta la próxima.

Until next time.

Y si usan la nube para guardar sus documentos importantes, quizás es buen momento para pensar en dónde están esos servidores exactamente.

And if you use the cloud to store important documents, maybe it's a good moment to think about exactly where those servers are.