Is Virginia's Data Center Boom Creating a National Security Chokepoint?

By Courtney Turrin · June 18, 2026 · 10 min read read

Category: News & Politics

Tags: AI

Virginia's booming data center industry may be creating a single point of failure for internet traffic, risking national security.

In 1964, a researcher named Paul Baran at the RAND Corporation was working on a problem: how could the United States maintain communications if a Soviet nuclear strike took out major infrastructure nodes?

His answer became the architectural blueprint for the internet.

"The basic network configuration was simple," Baran later explained in an interview conducted by Judy O'Neill in 1990. "Avoid any central node. Build a distributed network of nodes, each connected to its neighbor." If one point was destroyed, every surviving point could still reach every other node in the network. No single location could take the system down because no single location was essential to it. He called it a distributed network. The Defense Advanced Research Projects Agency (DARPA) built on his work to create ARPANET, which became the predecessor to the modern internet.

Sixty years later, a map of American data center infrastructure tells a different story.

The concentration

By Virginia's own economic development authority's account, roughly 70% of the world's internet traffic either originates or passes through Loudoun County, a stretch of Northern Virginia about 34 miles outside Washington, D.C., that the industry calls "Data Center Alley." That figure is widely cited and widely contested. Cardinal News, a Virginia-based outlet that has investigated the data center industry closely, reported in July 2025 that the defensible share is closer to 22%. Either way, it is the highest concentration of internet infrastructure in any single location on earth.

Now the concentration is extending south, down the Interstate 95 corridor, into Central Virginia. (Figure 1)

[datawidget key="va-data-centers-by-market"]

In June 2025, EdgeCore Digital Infrastructure announced a planned $17 billion data center campus in Louisa County. Five months later, CleanArc Data Centers announced a $3 billion campus in Caroline County. In Henrico County, data center giant QTS is moving forward with plans to add 17 new buildings across two campuses totaling 1,100 acres, a build-out that would bring its White Oak Technology Park footprint to 8 million square feet. Residents in Varina showed up to a county supervisors meeting in May 2026 carrying signs reading "No More Data Centers."

This southward march isn't geographic dispersal in any meaningful security sense. It follows the same fiber backbone, the same regional power grid, the same I-95 spine as the concentration it's extending from. For the argument that Virginia's data center build-out presents a national security risk, the pattern of expansion strengthens the case.

Network gravity

The concentration in Northern Virginia didn't emerge from a single decision. It accumulated through network gravity, a chain of individually rational choices whose aggregate nobody planned.

The roots trace to ARPANET itself. Federal government experiments in wide-area computer networking during the 1960s laid fiber infrastructure in Northern Virginia that commercial internet development later built on. In 1992, a group of network providers established the Metropolitan Area Exchange-East, or MAE-East, one of the first internet exchange points in the country, in the Northern Virginia suburbs. By the late 1990s, roughly half of internet traffic flowed through it. When Equinix built its first major data center in Ashburn in 1998, it selected a location near MAE-East for the same reason every company that followed did: that's where the traffic was. Each new connection added value to the exchange, which drew more connections.

Virginia locked the pattern in. The state's 2010 data center sales and use tax exemption on qualifying equipment, available through 2035, eliminated a significant cost driver. A 2024 Virginia Department of Taxation report described these incentives as "essential for maintaining Virginia's lead in data center development." Financial gravity compounded infrastructure gravity.

The internet's distributed architecture, Baran's design, was built to survive the loss of any node. The physical infrastructure beneath it concentrated in one place through the logic of markets and policy, without anyone asking whether the result was what Baran had in mind.

The chokepoint dilemma

There is a name for what this concentration creates. In strategic planning and infrastructure security, a chokepoint is any node where traffic, such as ships, fuel, goods, or data, must funnel through a narrow passage. What makes chokepoints dangerous isn't concentration itself; it's the absence of alternatives when the passage is disrupted.

History is detailed on what that looks like.

In 2003, President Hu Jintao warned China's Communist Party Central Committee about what he called the "Malacca Dilemma." The Strait of Malacca, a waterway between the Malay Peninsula and Sumatra, just 2.8 kilometers wide at its narrowest point, carried roughly 25% of global maritime trade and approximately 80% of China's crude oil imports. Hu identified it as a dangerous dependency: a chokepoint China didn't control. China spent the following two decades building alternative routes through the Belt and Road Initiative partly to reduce that exposure. A rival nation named its own chokepoint vulnerability and developed policy to address it.

The Suez Canal, carrying roughly 12% of global trade, demonstrated in March 2021 that chokepoints don't require adversaries to fail. A single container ship, the Ever Given, ran aground and blocked the canal for six days, disrupting more than $9 billion in trade per day.

The most instructive recent domestic example took place in May 2021. A criminal ransomware group called DarkSide attacked the Colonial Pipeline, a 5,500-mile system supplying roughly 45% of the fuel used on the East Coast. The group didn't breach the pipeline's operational systems; they compromised IT infrastructure using off-the-shelf ransomware tools. Colonial Pipeline shut down for six days, gas shortages spread across 17 states, and President Biden declared a national emergency. The government's own response confirmed the principle: concentrated infrastructure plus a single disruption point equals national crisis.

The federal government has already applied this lesson to technology. Taiwan's TSMC manufactures over 90% of the world's most advanced semiconductors. The United States named that concentration a national security risk and passed the CHIPS and Science Act, $52 billion in incentives designed to geographically disperse semiconductor manufacturing across domestic sites. The precedent for federal intervention in private technology infrastructure on geographic grounds is bipartisan and on the books.

Data infrastructure is no longer a theoretical target

During the recent U.S.-Israel conflict with Iran, Iranian forces bombed data centers in the Persian Gulf to destabilize military communications, a documented demonstration that adversaries have identified concentrated digital infrastructure as a pressure point in active conflict. 

The domestic track record makes the vulnerability concrete. Amazon Web Services' us-east-1 region, a Northern Virginia cluster that powers a significant share of commercial internet services, has experienced major outages in 2017, 2021, 2023, and 2025. In the 2025 incident, a DNS error in the Northern Virginia region took down Snapchat, McDonald's, Disney+, Signal, Fortnite, Venmo, Reddit, Coinbase, and Ring simultaneously, affecting millions of users globally. Article 19, an organization that monitors threats to freedom of expression, responded directly: "These disruptions are not just technical issues, they're democratic failures. When a single provider goes dark, critical services go offline with it — media outlets become inaccessible, secure communication apps like Signal stop functioning, and the infrastructure that serves our digital society crumbles."

The cloud industry's standard answer to this critique is that geographic redundancy already exists, through "availability zones", multiple facilities within a region designed to isolate failures. The problem is the scale. Availability zones are distributed across a few miles within the same geographic region. A power grid disruption, coordinated attack on regional fiber, or significant weather event hits all of a region's availability zones at once. The architecture distributes the risk within a county, not across a country.

The deeper issue is a distinction the industry tends to elide: the protocol layer and the physical layer are separate problems. Baran's packet-switching design routes traffic around failed nodes. That routing works when there are available nodes to route to. When a disproportionate share of the country's data infrastructure sits in one geographic region, the protocol can redistribute load among remaining nodes, but it cannot create new ones. The internet was built as a distributed system, but the buildings housing it were not.

How one rival is handling data center siting

China recognized this. Its Eastern Data Western Computing initiative, a multiagency strategy embedded in China's 14th Five-Year Plan and launched in 2022, is designed to distribute data center infrastructure across eight national computing hubs spanning the country's geography. The stated goals include resilience, renewable energy alignment, and economic development in underinvested regions.

China named the Malacca Dilemma for maritime infrastructure in 2003 and built policy to address it. It identified the data infrastructure equivalent and built policy to address that as well. The country most often cited as the strategic rationale for caring about U.S. digital infrastructure resilience has already done what this piece is calling for because it concluded that geographic distribution of data infrastructure is a competitive advantage, not an obstacle to AI ambitions.

A stateside policy model

The United States already has the legislative blueprint. The CHIPS Act didn't nationalize semiconductor manufacturing or require companies to close existing facilities. It used federal incentives to redirect where private investment flows, leaving established infrastructure intact while changing the trajectory of new build-out. The same mechanism is available for data infrastructure.

One legitimate technical constraint deserves acknowledgment: latency. For a narrow set of applications, including certain federal government systems and specific financial operations, proximity to Washington matters. That's a reasonable basis for a Northern Virginia cluster serving those use cases. It is not a reasonable basis for routing a significant fraction of the entire country's commercial internet infrastructure through one county, by default, because a 1990s exchange point happened to land there and a 2010 tax exemption made it cheap to stay.

For a detailed account of what geographic concentration already costs the communities living near it, in strained power grids, one-sided tax arrangements, and economic promises that don't materialize at scale, see our earlier reporting on what Richmond needs to know before it becomes the next data center capital. What's a local burden when concentrated in Loudoun County becomes a national vulnerability when the concentration itself is the risk.

CISA's critical infrastructure framework already designates information technology and communications as protected sectors. Federal authority to coordinate risk management in these sectors exists. A geographic distribution mandate does not.

Related: For a different response to the same concentration, see Will Melton's case for a Virginia Permanent Fund and a dividend for every Virginian.

The question Virginia can't answer alone

Before Paul Baran designed his distributed network, he studied the brain. He observed that it recovers lost functions by routing around dysfunctional regions, because no single cluster of cells holds exclusive responsibility for any given function. He applied that principle to communications infrastructure: distribute the nodes so that the failure of any one doesn't determine the fate of the whole.

The internet was built on that idea, even as the physical infrastructure running it concentrated in a single corridor along I-95.

Virginia's residents, local governments, and federal policymakers are watching a second wave of build-out take shape along that same corridor in real time. The question worth asking, before the answer becomes infrastructure, is whether anyone with federal authority is looking at the map and asking what Baran asked in 1964: what happens when one of these nodes goes down?