Ukraine’s strikes on data centers inside Russia aimed to disrupt military planning and communication services. There were also reports of another kind of disruption: to customers waiting for their dinner from food-delivery apps.

Kyiv’s drone strikes on three Yandex data centers in Sasovo, Kaluga and Vladimir saw delays and interruptions for thousands of businesses and households that rely on Yandex’s cloud infrastructure, including e-commerce, digital payment platforms and apps of food delivery and car services. Ukrainian drones on Wednesday targeted a major Sberbank data center in Russia’s Saratov region, though a senior company executive said it hadn’t affected operations.

After the strikes on Russian data centers, Kyiv noted that Moscow has already repeatedly targeted its digital infrastructure. “Ukrainians wanted to show Russians that two can play this game,” a senior official familiar with the operation told POLITICO, granted anonymity to discuss sensitive matters.

The attacks and counter-attacks point to a new frontline in war: the infrastructure powering the digital economy.

The attacks on the buildings that supply compute power are akin to striking a power plant supplying the electricity, heating and fuel that both militaries and civilians depend on. It may weaken an enemy’s war effort but can also bring everyday life to a standstill.

Experts say the cost of rebuilding in Russia will be particularly high as the centers require scarce materials that must be imported. “Obtaining a large amount of equipment to replace what was destroyed is not going to be easy,” said Oleg Shakirov, a cyber policy and international security researcher, noting that most hardware needs to be imported and that is complicated by high global demand and sanctions on Russia.

“To be honest, no one really knows what’s the actual damage. Since two data centers are still offline, we can assume that it’s significant,” said Shakirov.

Joseph Jarnecki, a senior research fellow at the Royal United Services Institute, warned that normalizing strikes to data centers could have a new set of dangerous consequences.

“These strikes likely breach International Humanitarian Law and it’s a big risk when global populations increasingly rely on digital services,” he told POLITICO.

When servers become targets

Data centers have entered the crosshairs of other recent armed conflicts. During the U.S.-Israeli conflict with Iran earlier this year, drone strikes hit three Amazon Web Services (AWS) facilities in the United Arab Emirates and Bahrain.

Since data centers can serve civilian and military purposes simultaneously, the legal status of targeting them is far from straightforward.

Kubo Mačák, an expert on international humanitarian law, said a data center must meet two conditions to qualify as a military objective under the Geneva Conventions: it must make an effective contribution to military operations and destroying it must offer a “definite military advantage.”

“If you know that they are storing military intelligence or that they’re using the data center to power military artificial intelligence tools,” Mačák said, there could be grounds to consider it a military objective.

Following the most recent strikes of the Yandex data centers, users on social media platform X reported a sudden drop in automated bot activity, including from accounts associated with pro-Russian, pro-Trump and Germany’s far-right Alternative for Germany (AfD) narratives.

Ukrainian President Volodymyr Zelenskyy seized on the reports to boast that the strikes had made social media less toxic, even as independent researchers and national research institutes found no evidence they specifically disrupted any Russian disinformation campaigns.

Mačák said that even if a data center is being used to “let’s say, run some trolls or these bot farms to interfere with elections abroad … that would not be sufficient.” In other words, hosting propaganda bots does not, by itself, make a data center a lawful military target.

The dual-use quandary has often focused on the targeting of energy infrastructure, which has been frequent in the Russia-Ukraine war. On Saturday, U.S. President Donald Trump urged Ukraine to stop striking Russian oil refineries, blaming the attacks for rising fuel prices. He has since called for both sides to halt attacks on energy infrastructure, although the existence of any ceasefire agreement remains disputed.

As data centers become increasingly central to national economies, they will become more consequential targets. A senior NATO official granted anonymity to discuss the matter told POLITICO that data centers are already considered potential targets and that the alliance is factoring their vulnerability into its planning.

NATO allies recognize that their data centers could come under attack in a conflict, the official said: “We would get it in a fight.”

Veronika Melkozerova in Kyiv contributed to this report.

LONDON — The Mayor of London Sadiq Khan and U.S. tech company Palantir have agreed to drop legal proceedings relating to a blocked £50 million police contract.

Palantir brought a claim against the Mayor’s Office for Policing and Crime in the High Court in June after Khan’s deputy mayor refused to sign off on the £50 million contract with the Metropolitan Police for the provision of an AI and data analysis service.

In July, lawyers working on behalf of MOPAC in turn accused the Met Police and Palantir of coordinating to fix the outcome of the procurement process in breach of the rules. Palantir claimed Khan’s office had unlawfully blocked the contract over the company’s “values and ethics,” based on media reporting.

A full trial was expected in January but on Wednesday both sides agreed to “settle their differences” and drop the allegations without admitting liability. They will each cover their own legal costs.

In an agreed statement, the two sides said MOPAC’s decision to block the Palantir contract was “not based on Palantir’s values or ethics or any wider reporting about the company,” though MOPAC said it “recognizes Palantir’s concerns that media reporting of a statement from the Mayor’s spokesperson before the decision was taken could have incorrectly created the impression that an assessment of the company’s values had been a factor in that decision.”

“MOPAC’s consideration was based upon its statutory role of examining spend proposals, against the appropriate legal tests and the relevant guidance on procurement, governance, affordability and ensuring value for money for Londoners and in doing so it focussed on the available information at the time,” the statement said.

The settlement also notes that MOPAC is working with Metropolitan Police Service to re-run a competitive procurement for the relevant service, which Palantir will be eligible to bid for.

“MOPAC does not have, and has never had, any policy of not contracting with Palantir,” the statement confirms, while noting the mayor’s duty is to ensure “all procurements are lawful, fair, transparent and deliver value for money.”

“London is the technology capital of Europe, and I am proud that leading software firms choose the city as their home. Palantir makes a significant contribution to jobs and investment in the capital, employing a large number of Londoners whose services have been procured legally by organizations across the U.K. and beyond,” Khan said.

Federal authorities arrested a Saudi national employed at OpenAI and charged him with planting a recording device in a company’s executive conference room, the Department of Justice announced Tuesday.

On or around Sept. 30, OpenAI discovered a sophisticated recording device inserted into the back of a television in an executive conference room located in one of its San Francisco offices. The company determined that the device was installed approximately a couple days prior, concealed in toilet paper. The contents of the device were encrypted, according to the DOJ.

The Department of Justice said in a news release that the employee, Abdulrahman Alfozan, 35, was arrested Friday and appeared in federal court Tuesday. OpenAI confirmed the incident on social media and said that it was supporting the FBI’s investigation.

“We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier,” OpenAI said in its statement. “At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data.”

Alfozan used a “productivity tool” to inquire about the company’s meeting rooms, calendars, and “leadership and exec” locations, according to OpenAI’s complaint to the DOJ. A chatbot account associated with his spouse also indicated that the user submitted prompts in September relating to installing and remote accessing a recording device.

The DOJ said that CCTV footage showed Alfozan, who had been employed as an engineer by OpenAI since July 2025, near and inside the conference room on multiple occasions before the device was discovered. Meetings in the conference room “frequently involved discussions of highly confidential technical, commercial, and strategic information, including proprietary research, product plans, and business-development opportunities,” according to the complaint.

The company also discovered another recording device in one of Alfozan’s bags left in the office.

“We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest,” OpenAI said. “Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.”

The Saudi national, who has since been fired by OpenAI, faces a maximum penalty of five years in prison, a $250,000 fine and three years of supervised release if convicted, according to the DOJ.

“For us it is a matter of national security,” U.S. Attorney Craig H. Missakian for the Northern District of California said in a statement. “This arrest highlights our relentless efforts in partnership with the FBI to identify and prosecute those who seek to steal our technology, as alleged in the complaint.”

BRUSSELS — Privacy regulators want people wearing smart glasses in public to look and sound like a truck backing down a road.

Europe’s powerful data regulators have made stringent new recommendations on how smart glasses should alert people that the wearable devices are filming, including a combination of flashing lights, audio alerts and notifications sent to the phones of people nearby.

The European Data Protection Board (EDPB), made up of national privacy regulators across Europe, issued a statement about smart glasses on Tuesday, following a meeting in Brussels.

Privacy regulators are putting forward a united front on smart glasses, as privacy concerns about the wearable technology have multiplied since videos made with them have begun spreading online without the knowledge or consent of those being filmed.

The statement is not legally binding but will guide how privacy regulators in Europe assess whether smart glasses users and manufacturers are complying with EU privacy rules like the General Data Protection Regulation (GDPR).

The regulators said smart glasses manufacturers should implement a combination of transparency measures to make other people aware that they are being recorded.

The measures may include lights or sounds when users are recording, requiring smart glasses users to activate them with an audible voice command, sending notifications to the smartphones of people nearby and other design “clues” to help people spot smart glasses.

The group of privacy regulators said that not only should users of smart glasses respect other people’s privacy but that the devices’ manufacturers and people providing connected apps or services may also be responsible for making sure they comply with privacy rules.

The GDPR applies to companies and organizations, and doesn’t apply when people process personal data in a household context. The regulators said this household exemption should be “narrowly interpreted” when it comes to smart glasses, and would not apply when someone shares photos or videos of others “to an indefinite number of persons on a public social media account.”

Tech firms like Meta have pitched their smart glasses to consumers on the basis that they are sleek and discreet. Meta has included an LED light in its smart glasses, which activates while recording, which it has said is a key privacy safeguard.

Samsung and Google have also recently announced that they’re collaborating on a new line of “intelligent eyewear” set to launch later this year, and Apple is reportedly aiming to hit the market with its own smart glasses by the end of 2027. 

The regulators’ statement could now force smart glasses manufacturers to reassess whether and how they sell smart glasses to European consumers. The EDPB called for industry-wide standards to be developed to make sure people are able to spot smart glasses and understand how they process data.

The European group of privacy regulators also commissioned a study into the social acceptability of smart glasses, published today.

PARIS — French center-right presidential candidate Edouard Philippe accused his far-right rival Marine Le Pen of trying to force a Frexit in disguise with her euroskeptic campaign promises.

“There is something in Marine Le Pen’s proposals that has the potential to blow Europe up, or let’s say to crack it open,” Philippe said at POLITICO’s Paris Competitiveness Summit on Tuesday.

The former prime minister — who is currently the best-placed centrist candidate to challenge the front-running Le Pen, according to recent polls — said Le Pen’s plan to unilaterally demand a drastic cut to France’s contribution to the EU budget was akin to “saying you want out of Europe” without openly advocating for leaving the bloc. Le Pen had previously called for a referendum in France on leaving the EU but dropped the proposal after her crushing defeat to Emmanuel Macron in the 2017 presidential election. Her party, the National Rally, now says it wants to change the EU from within.

Philippe, a fiscal conservative who has been pitching himself as the voice of reason in a campaign dominated by populist rivals, also slammed budget plans Le Pen unveiled last week as “grotesque,” accusing her of pitching “fantasy” savings.

Le Pen’s fiscal plans have faced serious scrutiny since being presented, with many observers saying they either lack key details or overestimate savings on major proposals like immigration. Progressive think tank Terra Nova wrote in a note out Tuesday that Le Pen’s budget presentation was “riddled with errors and contradictions” as well as “botched estimates.”

“She isn’t even able to estimate the cost of the pension reform she is proposing,” Philippe said.

Le Pen said in August that her plan to bring France’s legal retirement age back down to 62 for most workers would cost €9 billion a year, and last week she said she would lay out at a later stage how she intends to fund her flagship pledge. However, the Institut Montaigne, a fiscally conservative think tank, estimated the proposal would cost €34.7 billion a year.

Philippe is hoping to convince voters that his fiscally conservative agenda is the right path in a country burdened by a ballooning public debt and a budget deficit still above 5% of gross domestic product, in breach of EU rules.

Philippe said France needed to get its finances back on track to regain credibility on the European stage after a “loss of influence” over the past few years.

Though he currently leads a crowded field of centrist candidates, Philippe’s campaign has struggled in recent weeks to gain momentum — and far-left candidate Jean-Luc Mélenchon is now challenging the former PM for second place in the polls. France’s presidential election goes to a runoff if no candidate receives more than 50% of the vote, and Le Pen’s strong poll numbers all but guarantee her a spot in the second round.

Tough on China

The former prime minister pitched a pragmatic European agenda with less regulatory burden, more focus on investment and a tougher approach to China.

Philippe had some harsh criticism for an already embattled flagship measure of the EU’s green deal, saying the 2035 combustion engine ban has been “disastrous.”

There was “a great naiveté toward China,” which ultimately benefited from Europe’s push on electric vehicles, Philippe said.

“We need to much better protect our market,” he added. “If one wants access to the European market, one has to manufacture in Europe. If a carmaker doesn’t manufacture here, then we have to slap high tariffs.”

The EU is in the process of drawing up new “Made in Europe” rules that would favor European producers over those outside the bloc, in response to trade practices by competitors like China and the United States.

Shortly before Philippe took the stage, European Commissioner for Industry Stéphane Séjourné said at the POLITICO event that a Franco-German deal trading stronger protections on the definition of Made in Europe in exchange for a loosening of combustion engine rules should be finalized “in the next few hours or in the next few days.”

On artificial intelligence, Philippe aligned himself with Macron, advocating for European sovereignty in the field and the need to regulate what he described as “an instrument of power.”

“What I see is an AI world making money for the U.S. with European savings and European data, and that bugs me,” he said.

European organizations have to reckon with how to keep up with the modern world without sacrificing sovereignty. Geopolitical instability, tightening regulatory expectations and the rapid adoption of artificial intelligence (AI) mean that, for many organizations, sovereignty now sits alongside resilience and business continuity in board-level risk discussions. The question they can no longer defer is how to harness the opportunities of the modern cloud without surrendering control over their own data. Answering it requires honesty about what sovereignty means, and about where it can actually be found.

A definition Europe can trust

The European Commission’s forthcoming Cloud and AI Development Act (CADA) is the right vehicle for that honesty: giving Europe a shared, enforceable definition of what “sovereign” actually means. Without such a definition, the market is filled with commercial offerings that claim the sovereignty label without delivering the substance, a practice described as “sovereignty washing.” This gap has led some organizations to treat open source as the answer. But open source software is a licensing model, not an operating model, and it doesn’t settle questions about infrastructure or jurisdiction or even reliability and access. It’s not a route out of dependency, it’s a different dependency on project sponsors and code maintainers. A definition gives policymakers a way to properly assess claims of sovereignty against a consistent standard rather than taking marketing at face value.

Europe should not wait for CADA to take effect before acting, though. European cloud service providers (CSPs) have been partnering with established technology providers to deliver real sovereign capability, without rebuilding the entire technology stack from scratch.

The best time to plant the sovereign tree was 10 years ago

If Europe wants to grow its industrial base, it has to support the ecosystem as it is now, not as it may in 10 years’ time. CADA’s own roadmap assumes roughly five to seven years to triple the EU’s data-center capacity. Providers who have already built capacity by blending EU capabilities with proven non-EU technologies would have to spend the intervening years relinquishing their growth. It is scale, not a shortage of skills or innovation, that is the biggest practical obstacle facing a stronger European cloud market. This is precisely why partnership with proven technology sources deserves a central place in the sovereignty debate rather than being treated as a second-best option.

Partnership shortens that timeline considerably, letting European CSPs deliver sovereign, scaled services now instead of waiting for domestic capacity to catch up organically. In Italy, IPZS, owned by the Italian Ministry of Economy and Finance, is using this model to build a modern Digital Application Platform for the Italian EUDI wallet, a foundational EU digital identity initiative. It provides a live example of that model working in Europe today, at the scale and speed the policy window demands.

It is through scale that the local industrial base can deliver sovereign capabilities, compete, capture market share, and invest in developing and integrating home-grown technologies. Hoping for the alternative to happen, that is for a European technological stack to fully emerge and be adopted, is the equivalent of putting the cart before the horse.

The rules need to allow for a model that’s already working

Providers, such as evoila, are now operating well beyond Europe’s borders, alongside Uniserver. This shows the model working at a broader scale, combining local operational and jurisdictional control with proven technology. Sovereignty spans jurisdictional, technological, operational and supply-chain dimensions, and a partnership model can address all four while drawing on technology already proven at scale, rather than asking every layer to be rebuilt from first principles by a single European provider.

Alongside its cloud platform, developed in-house and operated from data centers in Europe under EU jurisdiction, IONOS also offers customers a dedicated VMware-based private cloud. It is also operated within the EU and designed to provide European data sovereignty and operational control.

Broadcom’s role in that model is deliberately narrow. It supplies the VMware cloud software layer to the CSP, while the CSP itself runs the infrastructure and holds the customer relationship, so that no European customer data passes through Broadcom or is subject to its access. Trust, in this model, follows the architecture rather than the brand. If CADA’s tiers implicitly assume that sovereignty can only be delivered by a fully European-built stack, CADA would shut out precisely the route that is already allowing Europe to scale fastest: partnership between local operators and proven technology providers.

The path forward

Europe does not have to choose between moving quickly and building sovereignty. The two are compatible, provided the legislation is calibrated to recognize it. As the European Parliament and European Council work on CADA, the priority should be for it to recognize and reward the partnership models already delivering sovereign capability across Europe today.

The above column is sponsor-generated content.

---

Disclaimer

POLITICAL ADVERTISEMENT

• The sponsor is Broadcom Inc.
• The political advertisement is linked to Broadcom’s software business and advocacy around the Cloud and AI Development Act (CADA).

More information here.

BRUSSELS — The European Union’s cybersecurity agency and in-house research center have each begun experimenting with open artificial intelligence models from China, three EU officials have told POLITICO.

The Joint Research Centre (JRC) — the EU’s in-house scientific research center — is evaluating “publicly available open-weight models” originating from China, European Commission spokesperson Maciej Berestecki confirmed. The head of ENISA, the bloc’s agency responsible for cybersecurity, also said in an interview that his team was now testing Chinese AI.

The experiments with Chinese models at the JRC are part of a broader research project to evaluate artificial intelligence that also includes leading models from the United States and Europe, Berestecki said. “Models from different origins are included in a comparative scientific evaluation of their capabilities, performance, limitations and risks,” he said, adding that the JRC is also looking into their potential scientific applications.

AI safety and security — topics currently under intense scrutiny following a series of incidents in which advanced AI models hacked real-world networks during testing activities — are not the core focus of the JRC’s testing activities, according to a different Commission official, who was granted anonymity to discuss sensitive material.

Open-weight models are those whose core components are publicly released, allowing anyone to run the model and study how it works. China’s approach to AI has leaned more towards open models than the United States. Some major U.S. tech and AI companies, including chips giant NVIDIA, are investing in open-weight models.

Forced to choose

The U.S. and China are locked in a race to dominate in the technology, with Europe largely sitting on the sidelines. Without a viable European frontier model, European private and public organizations may be left to choose between American and Chinese providers for advanced AI applications.

In a recent speech, European Commission President Ursula von der Leyen suggested Europe should not try to win the frontier AI race. A top German tech company told POLITICO this week it was dropping Europe’s leading AI lab Mistral in favor of open-source Chinese models.

The JRC has not entered into any “bespoke access” or licensing negotiations with the relevant Chinese developers, Berestecki said. The models are run on the center’s “secure, on-premises scientific infrastructure” and the Commission is not intending to use Chinese models for its own purposes, he added.

EU cyber agency ENISA — which has gained access to advanced models from top U.S. AI firms Anthropic, OpenAI and Google — is also experimenting with “a couple” of open-weight Chinese models, its executive director Juhan Lepassaar confirmed in an interview on Wednesday. 

JRC and ENISA have been tasked with working together to set up an AI testing platform under a recent EU action plan on AI and cyber, the European Commission’s attempt to respond to the growing concerns after a series of incidents involving AI systems breaking out of testing environments and breaking into other organizations’ digital systems.