Data Center Targeting Is the New Front. The Workforce Knows This. The Headlines Are Catching Up.

The Pattern the Workforce Has Been Tracking

Data center targeting as a protest and disruption front is not new to the people who watch the cyber workforce's day-to-day operational picture. The Fox News piece flagging agitators united by Chinese money and hate for America targeting data centers describes a pattern the cyber workforce has been tracking for months. The targeting is real. The funding network is real. The headlines are catching up to what the floor already knows. Inside the wire, the pattern has been the conversation at the Cybercom mission analyst desks for the better part of two quarters.

The pattern has three observable components. The first is physical protest activity at construction sites for new hyperscale data centers in approximately a dozen U.S. metropolitan areas, including sites in Northern Virginia, Phoenix, the Pacific Northwest, and the Dallas metroplex. The second is coordinated public-comment campaigns at the relevant zoning and permitting authorities that have, in several documented cases, traced back to coordinated funding sources that are not who the public-facing comment authors claim to be. The third is the cyber-enabled targeting layer, which is what the operational floor at Cybercom has been most directly tracking.

The Authority Architecture for the Cyber-Enabled Layer

The authority architecture for tracking the cyber-enabled layer is the architecture that, as I have written in this column before, the public commentary least understands. The activity inside U.S. borders falls primarily under FBI Cyber Division jurisdiction under Title 18 authorities. The foreign nexus of the funding network falls under Title 50 intelligence authorities, with NSA and CIA equities depending on the specific actor cluster. The interagency coordination architecture exists precisely to bridge the jurisdictional lines without requiring either side to operate outside its lane. The architecture has been working in this case, by the working-level read across the agencies involved.

The architecture's working is not the same as the architecture's adequacy. The working means the agencies are sharing the indicators they have at the velocity the operational picture requires. The adequacy would mean the architecture is producing actionable disruption of the targeting activity at a tempo that materially affects the adversary's operational cadence. The disruption is happening at the margins. The cadence of the targeting is, by my read of the operational picture, continuing on roughly the same trajectory it has been on since the beginning of the year.

Why Data Centers

The reason data centers have become the front is straightforward when you back up from the surface details. Data centers are the physical substrate of the cloud economy. The cloud economy is the substrate of the AI training and inference infrastructure that the U.S. national security community considers strategically central to the next decade of great-power competition. Adversary actions against the data center buildout produce delays, cost overruns, and political friction that, in aggregate, slow the U.S. AI capacity buildout on the timeline the strategic competition is operating on.

The adversary calculation is rational. The U.S. response to date has not been calibrated to the rationality of the adversary calculation. The response has been calibrated to the surface protest activity, which is the visible top layer of an operational stack the adversary is running deeper than the surface. The operational stack runs from the funding networks down through the persona infrastructure to the cyber-enabled targeting at the bottom of the pyramid. Surface response to surface protests does not interrupt the operational stack. The interrupt requires going below the surface.

What the Workforce Would Recommend If Asked

What the workforce would recommend if asked, in my reading of the operational floor's working-level analysis, includes three categories of action. The first is sustained interagency funding-network mapping at the depth that produces actionable disclosures, which the architecture is currently doing at a thinner depth than the operational requirement supports. The second is targeted public-attribution actions against the funding network, which the FBI's National Security Division has the authority to pursue but has been pursuing at a cadence the operational picture suggests is too cautious. The third is cyber-domain action against the targeting infrastructure, which is the Cybercom authority lane.

The third category is the category that requires the most institutional will. The infrastructure being targeted is, in the cyber-domain, primarily foreign infrastructure that the U.S. would act against under Title 10 authority. The action requires the authorizing chain to be present, current, and willing. The chain has been present and current. The willingness has been the variable. The variable has been moving in the direction the operational picture requires, but not at the velocity the operational picture is moving at. Operationally, the authority answers the question before the politics does. The politics has been the chokepoint.

What the Workforce Is Doing Anyway

What the workforce is doing anyway, regardless of the institutional chokepoint, is the kind of operational discipline that holds the line at the level the discipline can hold the line at. The cyber mission force analysts running the day-to-day tracking are producing the indicators at the cadence the operational picture requires. The FBI Cyber Division analysts are converting the indicators into investigative leads where the authority supports it. The CISA partnerships with the affected data center operators are producing the defensive uplift at the operator-level that closes some of the gap the architectural chokepoint leaves.

The workforce is the variable that has been holding this front together. The workforce will continue to hold the front together for as long as the workforce can sustain the operational tempo it has been sustaining. The capability has been there. The will has been the variable. The variable will be tested in the coming quarters as the targeting activity continues on the trajectory it is on. The Fox News piece is the surface signal. The deeper signal is the operational picture the workforce sees that the public reporting has not yet caught up to.

What I Would Tell a New Officer

What I would tell a new officer assigned to this front is what the older officers will tell the new officer in the unit's onboarding process. The workforce is the workforce. The architecture is the architecture. The will is the variable. The chain of authority is the chain that determines what the workforce can do operationally at the cadence the operational picture demands. Find the lawyers who have been working this front the longest. Read their memoranda. Understand the boundaries the memoranda articulate. Operate cleanly within the boundaries. The cleanness is the protection. Without the cleanness, the operational latitude shrinks. With the cleanness, the operational latitude is the latitude the architecture supports.

In the after-action, the workforce that held this front together at the working level will be the workforce the institution most consistently fails to credit. That has been the pattern. The pattern will not change this quarter. The workforce will continue to do the work because the work is the work. That has been the constant. The constant is what holds when the variables move.