Protecting America’s data centers is becoming a local policing challenge

When a company proposes a data center, there is usually no shortage of discussion about jobs, tax revenue, electricity and water.

I want to know who has spoken with the police chief or sheriff.

Not simply notified the department that a project is coming. Sat down with the people who will answer the emergency call and asked what they need to do the job.

These facilities may look like warehouses, but what happens inside them can have national and international consequences. They support financial transactions, healthcare systems, government operations, communications and artificial intelligence. Their customers may be thousands of miles away. The officer responding to a threat will likely come from a few miles down the road.

That is where this becomes a local public safety responsibility.

Having spent decades in policing and national security, I worry that we are allowing the cybersecurity discussion to overshadow some basic questions about physical security, emergency response and preparedness. A facility can have sophisticated cybersecurity, private security and a corporate emergency plan. None of that necessarily tells us whether the local police department has the personnel, training, equipment or information needed to respond to a serious incident.

When the call comes, dispatch will send whoever is available. The officer arriving at the gate should not be discovering the facility’s importance for the first time.

The consequences can extend beyond the facility

The importance of a data center lies not only in the building or equipment, but in the services that depend on it. A disruption could affect businesses, government operations or other essential services far beyond the jurisdiction where the facility is located.

Consider an exercise involving a credible security threat and an unexplained outage at the same facility. Police need to assess the threat, firefighters must evaluate potential hazards, the operator is trying to restore service, and federal partners may need to determine whether the incident has broader implications.

Who can authorize emergency access? Who knows which services are affected? Who coordinates with neighboring jurisdictions? How will the company and responding agencies share information without compromising an investigation or exposing sensitive customer information?

Those are questions that should be answered before an emergency, not during one.

Police executives should be involved in developing response plans, establishing relationships with facility operators and determining whether existing resources are sufficient. The company may know its own systems and security requirements, but local responders bring expertise in emergency operations, incident command and public safety. Both perspectives are necessary.

Physical threats deserve attention

Recent attacks on data centers overseas illustrate why physical security belongs in the discussion.

Reuters reported that an October 8 Ukrainian drone strike caused a fire and suspended operations at Yandex’s Sasovo data center in Russia, which housed two of the company’s AI supercomputers. Additional strikes reportedly affected facilities in the Kaluga and Vladimir regions.

The circumstances in Ukraine and Russia are very different from those in the United States. Nevertheless, the incidents demonstrate that disrupting digital infrastructure does not necessarily require penetrating its software. Physical damage can also interrupt operations.

There is broader national security context. In a joint advisory concerning Volt Typhoon, CISA, the National Security Agency and the FBI assessed that Chinese state-sponsored actors were positioning themselves within U.S. critical infrastructure networks to enable disruption during a major crisis or conflict. That advisory addresses critical infrastructure broadly; it is not evidence that a particular American data center faces a physical attack.

For local law enforcement, the lesson is not to treat every facility as an imminent target. It is to understand which facilities operate within their jurisdictions, what vulnerabilities may exist and which federal partners should be involved if a threat emerges.

An incident that begins as a local call for service may require assistance from the FBI, CISA, a fusion center or other agencies. Those relationships should already exist when that call comes.

Distinguishing threats from lawful opposition

Data center development has also generated considerable public opposition, often involving concerns about electricity consumption, water use, land development and effects on surrounding communities.

Police agencies must distinguish lawful protest and community opposition from credible threats, criminal conduct and suspicious activity. Residents have every right to question or oppose development projects. That opposition should not be treated as a security threat simply because it involves a sensitive facility.

At the same time, agencies need processes for documenting and assessing credible threats, insider concerns and incidents that may warrant coordination with federal authorities.

Information sharing matters. An incident that appears isolated at one facility may take on greater significance when compared with reports from other jurisdictions. Police, operators and appropriate intelligence partners should understand what information can be shared, with whom and under what circumstances.

The goal is not to turn routine community activity into intelligence collection. It is to ensure that genuine threats are recognized and assessed appropriately.

Drones present risks and opportunities

Unmanned aircraft deserve particular attention in data center security planning.

CISA has identified physical and cyber risks associated with drones operating around critical infrastructure. A drone sighting alone does not establish hostile intent, but operators and responding agencies should have procedures for documenting concerning activity, preserving relevant information and notifying the appropriate authorities.

There is also an opportunity to use properly authorized drones to improve security and emergency response. At a large facility, an aerial view may help personnel assess an alarm, locate a potential hazard or understand conditions before officers enter an area.

These capabilities should be evaluated against specific operational needs. Do they improve situational awareness? Reduce response time? Help responding officers make safer decisions?

Agencies must also consider privacy, flight authorization, operating responsibilities and the legal limitations on detecting or mitigating potentially hostile drones. Using drones to support security patrols is not the same as taking action against an aircraft considered a threat.

Those distinctions need to be understood before agencies or operators invest in technology.

A corporate security plan is not a public safety response plan

Many data center operators make substantial investments in security. That is appropriate, but the existence of a corporate security plan does not mean the local response has been adequately addressed.

A company’s plan may identify its own personnel, systems and responsibilities without establishing how police, fire, EMS, dispatch and emergency management will coordinate during an incident.

Who has authority to make decisions after hours? How will emergency responders enter a secured facility? What happens when preserving evidence conflicts with restoring operations? Who communicates with the public? What mutual aid or specialist resources may be needed?

The scale of these facilities makes the resource question especially important. A company may operate data centers across multiple states and have substantial corporate resources. The police agency responsible for the first response may have only a handful of officers available.

It is unreasonable to assume that local government can absorb every new security responsibility without evaluating its staffing, training and equipment needs.

Operators should be part of that discussion, including how they can support the preparedness their facilities require. That might involve joint training, exercises, access arrangements, specialized equipment or other resources identified through a realistic assessment.

Industry participation should begin during development discussions, not after the facility is operating.

Planning must be tested

Loudoun County, Virginia, which has a substantial concentration of data centers, illustrates the importance of coordination between facility operators and public safety agencies.

Loudoun County Sheriff Mike Chapman offers this perspective: “I would like to see common public safety protocols developed with operators, police executives, fire services, emergency management and national security partners. Each jurisdiction will have different needs, but basic responsibilities should be explicit. Then exercise the plan. Test whether dispatch can reach the right person at 2 a.m. Test emergency access. Work through an incident in which service restoration and evidence preservation require coordination. Determine how agencies will communicate if normal systems are unavailable. Assign someone to correct each gap and give that person a deadline. A meeting is a beginning. It is not proof of readiness.”

The exercises Chapman describes should go beyond a conference-room discussion. They should identify who will make decisions about public messaging, evidence preservation and service restoration, and who will be responsible for correcting any gaps.

A plan that has never been tested provides limited assurance that it will work when needed.

National importance requires local investment

I support investment in America’s digital infrastructure. These facilities are increasingly important to the economy and to services people depend on every day. But their importance also creates responsibilities that cannot be left entirely to the local agencies expected to answer the emergency call.

Police chiefs and sheriffs should have a meaningful role in planning for these facilities, and operators should help develop, exercise and support the response capabilities their operations may require. Government leaders need to understand the demands placed on local responders and account for them when considering new development.

There is an opportunity for police and sheriffs’ associations, industry leaders and government agencies to establish common expectations rather than leaving every jurisdiction to develop its own approach. To advance that effort, the National Sheriffs’ Association will soon establish a National Data Center Security Working Group to assess domestic and international threats and develop practical recommendations for federal, state and local law enforcement agencies. The group will focus on strengthening coordination, preparedness and protection against threats including hostile drones, sabotage and targeted violence.

We should not wait for a serious incident to discover that a facility with national significance has become a local responsibility without a corresponding investment in readiness.

A data center may serve customers around the world. Its first emergency response still begins with a local dispatcher and an officer heading toward the gate. We owe that officer more than a corporate security plan.