According to Finland’s Security and Intelligence Service (Supo), data centres may be used as tools by authoritarian states.
There are already about 35 data centres in Finland with a capacity of over one megawatt, and more than 100 new data centre projects are underway, drawn by the country’s cheap, nearly emissions-free electricity and cool climate.
The Finnish Security and Intelligence Service (Supo) is concerned that municipalities may be weighing the revenue generated by data centres more heavily than the security aspects associated with them.
“Some of these projects are well-informed, but in some cases not all risks, specifically from the perspective of national security, have necessarily been recognised,” warns Supo intelligence analyst Veli-Pekka Kivimäki.
Kivimäki declined to comment on any specific projects, but urges municipalities to contact Supo before agreeing to any foreign-owned data centres.
Loopholes in the law
Authorities often receive information about projects too late due to loopholes in Finnish legislation, Kivimäki tells Yle.
If a foreign operator makes a corporate acquisition in Finland, it is reported to the Ministry of Economic Affairs and Employment. If it purchases a plot of land, the security of the deal must be assessed by the Defence Ministry.
But if a foreign company simply leases a plot of land and builds a new data centre on it, it may fall completely off the radar of security authorities.
“We don’t currently have any legislation that requires notification of such data centre projects,” says Kivimäki.
The same blind spot applies to situations where a foreign entity simply rents space in a ready-made data centre.
Since the law does not require the state to be notified of projects, the responsibility for assessing safety risks often falls on the shoulders of individual municipalities.
Kivimäki notes that the government is aware of the problem. Earlier this month, it released proposed legislation on screening and authorising foreign investments. If approved by Parliament, it will likely take effect about a year from now.
Should we worry about foreign data centres?
According to Kivimäki, data centre investments are fundamentally a good thing for Finland, but says that there must be careful scrutiny if the owners are linked to authoritarian countries such as Russia and China.
According to Kivimäki, there is a particular risk of security threats if a data centre’s actual ownership is unclear. If, for instance, Russia or China are found to be involved, that raises question as to where the stored data may end up.
“For example, China has legislation that allows it to force a company to cooperate,” Kivimäki points out. “So if there is such a state actor in the background, there’s a risk that data will start going to places we don’t want it to go.”
Another significant risks identified by Supo is that authoritarian states may try to use Finland to circumvent restrictions and sanctions on technology exports. For example, advanced chips needed for heavy artificial intelligence operations are currently banned from export to China.
“On the other hand, Russia is also unable to acquire them due to sanctions. In that case, it is possible that attempts will be made to circumvent sanctions by investing in computing power in countries like Finland and utilizing it from there,” Kivimäki says.
Know your customer
Meanwhile some “data centres don’t even want to know who their customers are. It practically enables criminal activity or state intelligence activities,” he adds.
Here, too, there is a gap in the legislation.
The EU’s NIS2 Cybersecurity Directive and the Finnish Cybersecurity Act oblige data centres to identify their customers. However, the law only applies to large companies. Smaller ones are only required to do so if their services are deemed to involve critical functions.
That leaves room for interpretation and abuse, suggests Kivimäki.
The Ministry of Economic Affairs hopes to close this loophole as well through a new investment permit act, expected to enter into force next spring.
It would require prior authorisation for any data centres over 100 megawatts – and for smaller ones if they provide critical services, as well as for any centre whose operations involve AI or quantum technology.
Overall, Kivimäki says the situation as improving. As he sees it, “awareness is starting to rise, meaning that we’re heading in a better direction.”
