Securing Low-Energy Data Centres in Sustainable Cybersecurity Infrastructure

Abstract

The global digital economy exists on a physical paradox: whilst the ‘cloud’ is an industrial physical infrastructure that uses a lot of electricity, water and other raw materials to operate. The emergence of this paradox has led to a significant doctrinal tension between a government’s obligation for cyber security against its government’s obligation for environmental sustainability as the European Union continues with its “twin transition” of digitisation and decarbonisation. In the paper, I will provide an analysis of the legal and technical implications of this conflict by examining how the NIS 2 Directive, GDPR and the recast Energy Efficiency Directive relate to each other. Finally, I will explain that the move towards using “low-energy” infrastructure will create new vulnerabilities that are not being addressed under current liability frameworks due to the adoption of liquid cooled systems; IoT-driven environmental controls; and lightweight cryptography. In addition, this write up discusses the “Sanitization Paradox”, which is a situation where data protection absolutism requires functional devices to be physically destroyed (shredded), creating a break in the circular economy for Critical Raw Material (CRM) commodities such as Neodymium and Cobalt. This write up synthesizes technical information related to “Green AI” and cryptographic efficiency with legal information regarding tort liability and regulatory compliance in order to propose a standard for “eco-efficient resilience” that balances the demands of security against the demands of sustainability.