Every Rack Is a Target: The Platform Economy's Expanding Battlefield
On August 7th, Yle published an interview with Martti Koskenniemi, emeritus professor of international law at the University of Helsinki, about Ukraine's strikes on Wildberries — Russia's largest e-commerce platform. Since the campaign began on July 18th, Ukrainian drones have struck close to twenty of the retailer's roughly two hundred warehouses and logistics centres, damaging an estimated 10% of its total logistics capacity, with warehouses hit as far as Yekaterinburg and Tver. Wildberries sells bulletproof vests, night-vision equipment, and drone components alongside washing machines and children's shoes. Ukraine says the platform supplies Russia's military. The Kremlin says the sites are purely civilian. At least nine people died in the July 18th Kotovsk strike alone, with further casualties across subsequent strikes.
Koskenniemi's answer to the obvious follow-up question is the one worth sitting with: could Iran, at war with the United States, have an equivalent right to strike Amazon's warehouses, on the grounds that Amazon also sells body armour and tactical equipment to buyers who say, when asked, that the intended use is military? "Voisi hyvinkin olla," he said. It could very well be.
He was not being provocative. He was describing where the actual law already sits — and the article never mentions that this is not a hypothetical. On March 31st 2026, Iran's Islamic Revolutionary Guard Corps formally designated eighteen American technology companies as legitimate military targets: Amazon, Microsoft, Nvidia, Google, Apple, Meta, HP, Tesla, Oracle, Boeing, Cisco, and IBM among them. Iran has since struck Amazon Web Services facilities specifically on multiple occasions — a UAE data centre on March 1st, two further UAE facilities and a Bahrain site in the same wave, and a dedicated strike on the Bahrain facility on April 1st causing a temporary service disruption. Yle's own coverage of the legal principle at stake, published the same week this essay was drafted, does not once connect it to the case that has already tested it. That gap — a serious international lawyer asked to speculate about a scenario that has already happened, without anyone in the room noticing — is itself the story.
Two Wars, One Legal Question, Zero Convergence in Coverage
The pattern is close to identical in both theatres, and the fact that European coverage keeps discussing them as unrelated stories is worth naming as a failure of analysis in its own right.
In Ukraine, Zelensky has justified the Wildberries strikes as "justified countermeasures aimed at depriving Russia's war machine of its resources," citing the platform's sale of drone components and navigation equipment. Koskenniemi's legal framework, drawn directly from the Geneva Conventions' Additional Protocol I, Article 52(2): an object becomes a legitimate military target when its nature, location, purpose, or use makes an effective contribution to military action, and striking it offers a definite military advantage. Absent verified proof, international law presumes civilian status — meaning the current presumption, Koskenniemi says explicitly, is that Ukraine is committing a war crime, reversible only if reliable evidence of substantial military support emerges. The proportionality principle compounds the problem: a single rifle in a vast logistics warehouse does not license a strike that kills dozens.
The evidence Ukraine has offered is more specific than a generic reference to "military gear." Zelensky named the sanctioned goods directly: drone production components and navigation equipment moving through Wildberries' Nevinnomyssk and Kotovsk warehouses to Russian forces operating in Ukraine. Ukrainska Pravda's reporting adds fibre-optic cable for drones, propellants, microcontrollers, and video cameras to the list of dual-use goods the platform sells openly. And unlike the Amazon case, where the military effect remains unconfirmed, Ukraine has produced an operational-impact claim from its own chain of command: Colonel Yurii Fedorenko, commander of Ukraine's 429th Separate Unmanned Systems Brigade, stated publicly on August 1st that the strikes had disrupted Russian drone-component supply badly enough that Russian units introduced restrictions on cameras, propellers, controllers, and batteries at the front. Wildberries itself quietly removed a dedicated "Everything for the SMO" product category from its site in late July, after the strikes began — a change in behaviour that is difficult to reconcile with the platform's own public position that it plays no role in supplying the war.
None of this settles the legal question Koskenniemi is describing — proportionality and verified military use remain live, contested tests, and the presumption of civilian status still applies to whatever the strikes haven't destroyed yet. But it substantially strengthens the evidentiary record beyond what a single consumer review calling a bulletproof vest "military use" could ever establish on the Amazon side of this comparison, and it is worth being precise about that asymmetry rather than treating the two cases as evidentially equivalent.
In the Gulf, Iran has invoked precisely the same Article 52(2) logic against precisely the same category of target. On March 31st, Iran's Tasnim news agency — closely tied to the Islamic Revolutionary Guard Corps — published a list of roughly thirty sites across Qatar, the UAE, Israel, and Bahrain belonging to Amazon, Microsoft, Google, Oracle, Nvidia, IBM, and Palantir, describing them as "enemy technology infrastructure." Iran has since struck Amazon facilities in Bahrain and the UAE on at least four occasions between March and late July, most recently confirmed by satellite imagery showing significant damage at the Zallaq and Askar sites. Tasnim's stated justification, verbatim: "as the regional war expands into an infrastructure war, the scope of Iran's legitimate targets gradually broadens."
Both operators are making the same legal argument. Both are relying on the same treaty article. But the two cases sit at different points on the evidentiary spectrum, and the difference matters for anyone using them to think clearly about where this trend goes next.
Wildberries is the stronger case, evidentially, because Ukraine's claim is about the marketplace itself — its listed inventory of sanctioned dual-use goods, its documented role as the largest warehouse capacity near the front, a Ukrainian brigade commander's on-record statement of measurable operational effect. Amazon is the weaker and more structurally interesting case, because Iran's claim is not primarily about what Amazon sells retail — a single consumer review calling a tactical vest "for Middle East deployment" would be a naive basis for a targeting decision, and it is not, in fact, the basis Iran has cited. Iran's stated justification is about what Amazon hosts: the Joint Warfighting Cloud Capability contract, and the compute infrastructure reportedly used to accelerate American military AI applications during Operation Epic Fury. That is a claim about backend infrastructure and government contracting, not about marketplace listings — a categorically different, and legally more serious, kind of dual-use argument than "this platform also sells things soldiers buy."
Le Monde Diplomatique's contributors have called dual-use rhetoric what it structurally is: a "political technology" that instrumentalises the blur between civilian and military space to legitimise violence that would otherwise be clearly unlawful, deployed from two diametrically opposed positions simultaneously — humanitarian lawyers trying to hold the line, and belligerents trying to erase it.
Neither Le Monde Diplomatique's contributors, nor Yle, nor most Western outlets covering either war individually, has yet published the piece that puts Wildberries and AWS Bahrain in the same sentence. They are the same phenomenon, tested twice, six months apart, on two different continents, by two different belligerents, against two different American-adjacent commercial platforms.
What the Amazon Strikes Actually Established
The Iran-Amazon case is more legally developed than the still-unfolding Wildberries case, and it is worth being precise about what it has and has not settled.
Legal analysts writing for Just Security, cited extensively in the Data Center Dynamics trade press coverage, established the operative standard clearly: under Additional Protocol I Article 52(2), military significance is a functional test, not a volumetric one. There is no threshold percentage of military workload required to convert an entire facility into a legitimate target — a single significant military function running on shared physical infrastructure can render the whole building a military objective, because logical separation between virtual machines, availability zones, and encrypted partitions does not solve what is, at bottom, a physical targeting problem. If a military AI workload and a retail bank's transaction processing sit in the same building, the building's status is determined by the military workload, not diluted by the civilian one.
This is where the story connects directly to sovereignty architecture rather than remaining a pure war-reporting item. Amazon holds a substantial share of the Pentagon's Joint Warfighting Cloud Capability contract, a $9 billion programme also involving Google, Microsoft, and Oracle. Reporting from The Intercept in March established that Anthropic's Claude — the tool assisting in the drafting of this essay — was reportedly used to accelerate American targeting decisions during Operation Epic Fury, the US-Israeli campaign against Iran launched February 28th, and that Claude's underlying compute runs in part through a data centre built with 500,000 chips in Indiana. Google executives were reported to have expressed internal uncertainty about how the Israeli military was deploying Google's own cloud services — meaning the provider itself could not confirm the boundary its own sovereignty marketing assumes exists. UNIDIR's April assessment called the March 1st Bahrain strikes the first documented case in history of a commercial data centre being deliberately targeted as part of a military operation, with consequences UNIDIR frames as extending well beyond the immediate conflict: for international peace and security, digital governance, AI in the military domain, and the accountability structures of humanitarian law all simultaneously.
The uncomfortable finding, stated by multiple independent legal analysts across UNIDIR, Just Security, and the Daily Kos legal analysis of the strikes, converges on the same sentence: nobody outside the companies and the militaries using them can currently verify where the civilian workload ends and the military one begins, and the companies themselves have said, on the record, that they sometimes cannot either.
The Rights-Advocacy Counter-Position
Not every serious voice accepts that this expansion should be treated as settled law rather than resisted as a dangerous drift, and the strongest push-back deserves full weight here.
SMEX, the Beirut-based digital rights organisation whose analysis this essay draws on directly, states its position without hedging: "data centers should not be considered lawful targets under international humanitarian law." Their argument is not naïve about the dual-use reality — it is a normative claim that the direction of travel is itself the danger, regardless of whether any individual strike can be technically justified under Article 52(2). A data centre hosting a bank, a hospital records system, a university, and a military AI workload simultaneously is not a hard case that occasionally arises. Under current cloud architecture, it is close to the default condition of any large commercial facility, which means accepting the expanding-target-list logic converts nearly all critical digital infrastructure into contestable military objectives as a matter of course, not exception.
The Yale Law Journal's 2025 analysis of "dual-use" as a category makes the sharper point still: international humanitarian law, properly read, does not actually recognise "dual-use" as a legal category at all. The Geneva Conventions draw a bright line between military objectives and civilian objects. "Dual-use" is a discourse that has grown up around that line over recent decades of urban and infrastructural warfare, and its function — demonstrated across schools, hospitals, apartment blocks, and power stations before it ever reached data centres — has been to blur the line, not clarify it, placing civilians at systematically greater risk with each war that normalises the term further.
This essay is not taking a side in that legal argument, and it should not. Whether Wildberries and AWS Bahrain are lawful targets is a question for international courts, war crimes tribunals, and the slow, contested work of customary law — not for an essayiste. What can be stated with confidence, because it is observable rather than adjudicable, is the trend: the range of commercial infrastructure that belligerents are willing to claim as legitimate, and that a genuinely eminent legal scholar is willing to concede "could very well" qualify, has expanded dramatically in six months, across two unrelated conflicts, converging on the same legal mechanism independently.
The Dubious Frontier: Even the Pentagon Is Split
The clearest evidence that this expansion has outrun anyone's comfort, including the belligerents' own institutions, comes from inside the US military itself. Reporting in Politico this year revealed internal Pentagon disagreement over proposed strikes on Iranian water desalination and treatment infrastructure — justified by some officials on dual-use grounds, since military forces also require water. Retired Air Force Lieutenant Colonel Rachel VanLandingham, formerly the head of international law at US Central Command, called the implied logic what it is: a justification broad enough to license striking "every single power plant that serves civilians," which she characterised as indiscriminate attack by another name. Amnesty International's position was blunter still: intentionally attacking civilian infrastructure such as power plants is generally prohibited, and even where dual-use status is genuinely established, proportionality still forbids strikes causing disproportionate civilian harm.
If the institution most invested in expanding its own targeting latitude is visibly uneasy about where the dual-use logic terminates, that unease is the most reliable signal available that the Overton window here is moving faster than the legal or ethical scaffolding meant to contain it.
What This Means for European Sovereignty Planning
This is where the essay connects to the broader argument this site has been developing since May, and where the risk stops being a Middle Eastern or Eastern European news story and becomes a European planning problem.
Every European institution — government ministry, hospital network, bank, university, defence contractor — running workloads on Amazon, Microsoft, Google, or Oracle infrastructure, in any region, under any sovereignty-branded product tier, is sharing physical or logical infrastructure with a company that a currently active belligerent has formally and repeatedly designated a legitimate wartime target. The AWS European Sovereign Cloud's data-plane and control-plane segregation — examined in detail elsewhere on this site — was never designed to address this risk category, because it cannot. Article 52(2) targeting logic, per Data Center Dynamics' analysis of the March strikes, treats logical separation as irrelevant to the question of physical targeting. A missile does not distinguish between a sovereign region and a standard region if a single building or a single regional hub houses both.
This is a different and considerably more acute version of the argument this site has already made about zero-day patch dependency and CLOUD Act jurisdiction. Those essays describe legal and operational exposure. This is physical exposure — the risk that a European sovereign cloud customer's infrastructure becomes collateral damage, or a direct target, in a war between two other parties, because the parent company's global commercial and military client base is inseparable from the physical facility hosting the European customer's supposedly sovereign workload.
The scale is worth making concrete rather than abstract. Newsweek's analysis of the Wildberries damage — roughly 10% of the platform's total logistics capacity destroyed or disabled within three weeks — translated that into an equivalent for Amazon's US operations: if a comparable share of Amazon's largest, most consequential facilities were disabled, on the order of 2.2 million deliveries a day could be delayed or cancelled. Substitute European government cloud tenancy for consumer parcels and the equivalent figure is not deliveries. It is hospital scheduling systems, welfare payment processing, court case management, and defence procurement records — all going dark simultaneously, not because Europe was the target, but because the building was.
The ICC Complication
One correction to an intuitive first instinct is necessary here, because the honest version of this argument runs in the opposite direction from where it might first appear to point — and the actual version is a sharper indictment of Washington's own strategic judgment than the intuitive one would have been.
The tempting frame is that the United States' rejection of ICC jurisdiction opens space for someone else to fill the accountability vacuum — a court that could, in principle, adjudicate whether Iran's strikes on Amazon or Ukraine's strikes on Wildberries constitute war crimes, regardless of whether Washington itself recognises the court's authority. That framing understates the problem, because it treats American non-participation as neutral. It isn't. The sharper reading is about what Washington actually lost by not merely abstaining but actively attacking the court's capacity to function.
The ICC, whatever its structural flaws and selective track record, was one of the few standing multilateral mechanisms through which a body of states broader than the US alone could formally constrain or delegitimise a belligerent's targeting doctrine — including a doctrine that treats American commercial cloud infrastructure as a legitimate wartime target. A functioning court ruling on Iran's data-centre strikes would have carried weight in the Gulf, in Europe, and well beyond, in a way a unilateral State Department statement never will; this site has already documented how little credibility Washington's unilateral legal claims currently carry outside its own borders, in the Ceuta case specifically. An ICC finding against Iran's targeting logic would have been a genuinely multilateral instrument bearing on a conflict where the United States has an obvious interest in constraining its adversary's options through law rather than escalation alone.
That instrument is now gone, and it was disabled before this specific crisis over data centres ever arose. Washington's campaign against the court — sanctions on ICC judges and prosecutors under Executive Order 14203, travel bans and asset freezes extending extraterritorially to third-country nationals who work with sanctioned officials, and, per the Coalition for the International Criminal Court's April 2026 report, a documented chilling effect that has seen banks and IT providers worldwide cut off basic services to designated individuals with no recourse — was triggered by the ICC's 2024 arrest warrants against Netanyahu and Gallant over Gaza, not by anything connected to Iran or cloud infrastructure. ICC Judge Solomy Bossa's account in the CICC report is direct: her US bank account was frozen within 24 hours of the executive order.
The strategic self-harm is the point worth naming plainly. In attempting to protect one ally from the court's jurisdiction, Washington degraded the court's authority and functional capacity for every other case simultaneously — including the cases, like Iran's targeting of American commercial infrastructure, where a credible multilateral ruling would have served American interests directly. The tool was not withheld strategically. It was broken for an unrelated reason, and the bill for that decision is now arriving in a theatre nobody was thinking about when the sanctions were signed.
The Argument This Essay Is Not Making
To be explicit about scope, because precision protects an argument's credibility more than force does: this essay does not argue that Ukraine's strikes on Wildberries are lawful or unlawful. It does not argue that Iran's strikes on Amazon facilities are lawful or unlawful. Those are questions for the courts, tribunals, and the decades-long process by which customary international law eventually settles genuinely contested cases — Koskenniemi is right that no international body currently exists with binding authority to resolve either dispute in real time.
What this essay documents is narrower and, for European planning purposes, more urgent: the range of commercial, civilian-facing platform infrastructure that state and non-state belligerents are willing to publicly claim as a legitimate military target has expanded significantly over the past six months, tested independently in two unconnected theatres, using the identical legal mechanism, against infrastructure operated by companies whose customer bases include European public institutions currently relying on that same infrastructure for services branded, marketed, and sold as sovereign.
The Overton window on legitimate targets has moved. Nobody voted on it. No treaty was amended. It moved because dual-use commercial infrastructure has become sufficiently embedded in military capability — AI targeting systems, drone component supply chains, intelligence processing — that belligerents calculated, correctly, that striking it would not trigger the kind of universal condemnation that striking a hospital or a school still reliably does. That calculation has been tested and, so far, has not been punished at a level that would deter its repetition.
Europe should assume it will be tested again, against infrastructure Europe depends on, in a conflict Europe did not choose and may not be party to. The sovereignty question this site has been developing since May was never only about who can subpoena your data. It is now also, unavoidably, about which buildings become legitimate wartime targets, and whether the ones your hospitals and pension systems run on are among them.
JP Ahonen is a transformation director, Finnish defence reservist, and independent analyst based in Porto Rafti, Greece.