The Chokepoint Problems

Iran's campaign against Gulf civilian infrastructure has continued. Kuwait's Ministry of Electricity, Water and Renewable Energy reported Iranian strikes on its power and desalination stations for a fourth consecutive night on 20 July, sparking fires and forcing generation units offline; the country draws roughly 90% of its drinking water from desalination.¹² Jordan and Bahrain were struck the same week, and two US service members were killed in an Iranian barrage against Jordan on 17 July.³ On 21 July, Iran's Revolutionary Guards claimed cruise-missile strikes had destroyed Amazon's data centre in Bahrain, part of a coordinated wave that also targeted a radar station and a Patriot air-defence battery elsewhere on the island; Bahraini officials said the strike was intercepted, and Amazon has issued no dashboard update either way.⁴⁵

The war then acquired a second maritime front. On 23 July the Houthis claimed missile and drone strikes on two Saudi oil tankers transiting the Red Sea, the group's first attack on commercial shipping in months; Saudi state media confirmed one vessel, the Encelia, was hit and caught fire. The Houthis framed the attack as enforcement of a blockade declared against Saudi ports, and threatened to close Bab el-Mandeb, the strait connecting the Red Sea to the Gulf of Aden.⁶ Trump said the US would hold Iran responsible for further Houthi attacks, and CENTCOM confirmed a twelfth consecutive night of strikes on Iranian targets.⁷ The Institute for the Study of War reported at least seven vessels had already diverted around Bab el-Mandeb.⁷ Front-month Brent traded above $100 a barrel for the first time since May.⁶

The compute-continuity question this raises is not new but has sharpened. Amazon has repeated its guidance that customers with workloads in Bahrain and the UAE should continue migrating to alternate regions, guidance first issued after the March strikes and reaffirmed again this week; Snowflake and Red Hat have issued equivalent notices to their own customers since March.⁸ That guidance describes redistribution within Amazon's own global footprint rather than named third parties winning displaced Gulf enterprise business, and no dated transaction evidencing the latter has yet surfaced; it belongs in this issue as a live continuity thesis rather than as a deal. A second-order exposure follows for whoever holds the physical shell rather than the compute layer itself: powered-shell landlords and ground-lease operators in Bahrain and the UAE have no equivalent of a hyperscaler's redistribution option, so a sustained shift away from the region would concentrate the downside on that passive real estate layer rather than on the cloud operators with somewhere else to send the workload.

Away from the Gulf, three separate China-Philippines clashes this week, examined in full in §6, ran alongside the ASEAN foreign ministers' meeting in Manila, and Brussels put a hard date behind eighteen months of cloud sovereignty rhetoric, examined in §7. The throughline across all four situations this week is not escalation for its own sake but a widening set of actors asserting the right to grant, deny or price passage through infrastructure that others depend on, whether that infrastructure is a strait, a shoal, a cloud region, or a municipal power connection.

The pattern connecting this fortnight's Gulf strikes is target selection rather than intensity. Kuwait's Doha West desalination plant was already damaged early in the war; this fortnight brought four further consecutive nights of strikes on power and desalination infrastructure, with the Ministry of Electricity, Water and Renewable Energy reporting fires and the shutdown of multiple generation units.¹ Kuwait draws close to 90% of its drinking water from desalination, and many Gulf desalination plants are co-generation facilities physically integrated with power stations, meaning an attack on either system can interrupt both.² Jordan and Bahrain were struck the same week; the deaths of two US service members in the 17 July barrage on Jordan were described by Eurasia Group founder Ian Bremmer as opening some of the most dangerous days of the war to date.³

On 21 July, Iran's Revolutionary Guards said their aerospace force had struck and destroyed Amazon's central data infrastructure in Bahrain with cruise missiles, describing the attack as the twenty-fourth wave of a named operation and linking it, alongside a radar-station and Patriot-battery strike elsewhere on the island, to a coordinated suppression-and-strike doctrine against both military and commercial targets.⁴ Bahraini officials have reportedly said the strike was intercepted, and Amazon's status dashboard carries no update reflecting either outcome.⁵ Independent of which account proves correct, Amazon's own guidance to customers, to continue migrating workloads out of Bahrain and the UAE to alternate regions, has not changed since it was first issued after the March strikes.⁸

The Houthi reopening of the Red Sea front on 23 July is the more structurally significant development. Yemen's Iran-aligned movement had not attacked commercial shipping since a 2025 truce; it now claims two Saudi tanker strikes, a blockade on Saudi ports, and holds open the threat of closing Bab el-Mandeb, the only practical maritime bypass for cargo that would otherwise transit Hormuz.⁶ Geopolitical risk advisors flagged the shift toward water and trade-corridor targeting as a likely next vector before the Houthi strikes materialised; Thomas Laing-Baker, Managing Director for Geopolitics, Investment, M&A and Defence at KPMG, set out the logic in a 21 July note, a couple of days before the Encelia episode.⁹ Investors should treat that as a useful pattern rather than a settled fact: the specific claim that Saudi Arabia's Red Sea export pipeline discharges into Houthi-held territory does not hold up, its terminus at Yanbu remains under Saudi control, but the underlying mechanism, that routing crude away from Hormuz via the Red Sea now carries its own Houthi-controlled exposure, is sound and worth underwriting directly.

Philippine and Chinese personnel clashed three times this week around two contested features in the South China Sea. On 20 July, at Second Thomas Shoal, the Philippine military said a China Coast Guard rigid-hull inflatable boat approached the grounded warship BRP Sierra Madre, and that Chinese personnel struck a Filipino navy marine with a baton, causing a head injury.¹⁰ On 23 July, near Scarborough Shoal, China's coast guard used water cannon and what Manila called dangerous manoeuvres to block Philippine vessels resupplying local fishermen.¹¹ A third clash was reported on 24 July.¹² The timing placed the confrontations directly alongside the ASEAN foreign ministers' meeting in Manila, where Chinese Foreign Minister Wang Yi was in attendance; the US State Department condemned the first incident as dangerous and aggressive, and Secretary of State Rubio repeated the characterisation on the sidelines of the summit, saying Washington would not abandon its allies.¹³

The commercial relevance for this audience runs through the corridor rather than through the shoals themselves. The waters east and south of Taiwan and the Philippines, including the Luzon Strait and Bashi Channel, carry a meaningful share of Asia-Pacific subsea cable traffic between Japan, Taiwan, the Philippines and Southeast Asia. Neither this week's incidents nor the coast guard patrol reported in Issue 017 have yet touched cable infrastructure directly, and that distinction matters: this remains a corridor-gatekeeping story, coast guard vessels asserting a right to interrogate and obstruct passage, rather than a cable-damage story. It may not stay that way if the pattern from the Gulf, where gatekeeping assertions preceded infrastructure strikes by weeks rather than months, holds here too.

The Cloud and AI Development Act was formally published in the Official Journal of the European Union on 15 July, converting the Commission's June proposal into a regulation with a fixed timeline. The law's four-tier sovereignty framework, ranging from EU-based data processing at the lowest level to full EU ownership and third-country independence at the highest, formally takes effect on 4 August, with the first assurance level applying to public-sector cloud procurement from February 2028 and the highest level phased in later still.¹⁴

The practical effect for this audience is a compliance and structuring question rather than an immediate operational one, given how far out the enforcement dates sit. Public authorities and, per the Act's stated ambition, an expanding set of critical-sector operators will be required to weight EU-based infrastructure, ownership and supply-chain transparency in procurement and risk assessment. Non-EU hyperscalers retain the ability to be recognised at lower assurance levels, but the associated-country mechanism for higher levels has already drawn criticism from US industry groups as a standard no major cloud jurisdiction, EU included, currently meets.¹⁵ For portfolio companies selling into EU public-sector or critical-infrastructure cloud demand, the diligence question from this week forward is which assurance level a target's current architecture and ownership structure could plausibly reach, not whether the framework will apply.

Wisconsin's Public Service Commission confirmed on 10 July that it has no plans to reconsider the credit-rating and financial-guarantee requirements it imposed on large-load data centre customers in April, despite a formal petition and a lawsuit from Oracle, whose Port Washington campus co-development could face more than $100 million a year in additional financial security costs under the current terms.¹⁶ The underlying regulatory logic, that data centre operators rather than the general ratepayer base should bear the cost and credit risk of new generation and grid capacity, is spreading rather than staying contained to Wisconsin.

Virginia's data centre consumption tax, a $0.011 per kilowatt-hour levy on electricity used by qualifying facilities, took effect on 1 July and is projected to generate roughly $600 million annually for the state's general fund.¹⁷ And earlier this month, voters in Monterey Park, California approved what industry reporting describes as the first voter-enacted municipal ban on data centre development in the United States, with 86% support, ending a local fight over a proposed facility backed by an Australian investment firm.¹⁸ Similar ballot and ordinance mechanisms are reportedly under consideration in Wisconsin, Nevada and several Maine towns.¹⁸

None of these three developments individually rivals the scale of the federal export-control fight, but taken together they confirm a structural shift this publication has been tracking since Issue 008: the binding constraint on new US hyperscale capacity is increasingly a local utility commission or a municipal ballot, not a federal permitting timeline. Underwriting models that treat siting risk as a national-average variable understate exposure in the specific jurisdictions where these mechanisms are now active.

• 01
  For any asset with Gulf-based cloud, power or water-adjacent exposure: has the operator's own guidance on customer migration been reviewed, and does the asset's own continuity plan assume redistribution within a single provider's network or genuine multi-provider diversification?

  AWS Bahrain migration guidance, reaffirmed 21 July
• 02
  For shipping, insurance or trade-exposed portfolio companies: has war-risk premium modelling been updated to reflect two simultaneously contested straits rather than one, and does coverage extend to Red Sea/Bab el-Mandeb routing specifically?

  Houthi Red Sea reopening, 23 July
• 03
  For EU-facing cloud or SaaS assets: at which CADA assurance level would the target's current ownership and infrastructure architecture realistically qualify, and what would migration to a higher level cost and take?

  CADA Official Journal publication, 15 July

• 04
  For Gulf-region data centre or utility assets: has physical security been independently reassessed since the Bahrain and Kuwait strikes, and does the operator's continuity plan distinguish between claimed and confirmed damage when triggering customer communications?

  Contested AWS Bahrain strike, 21 July
• 05
  For US data centre development assets in Wisconsin, Virginia, or any jurisdiction with an active or pending ballot measure: has the underwriting model been re-run against the Monterey Park precedent as a plausible outcome rather than a tail risk?

  Monterey Park ballot ban, 86% support, reported this month
• 06
  For subsea cable assets or operators with exposure to the Luzon Strait, Bashi Channel or wider South China Sea approaches: what is the current insurance and rerouting posture given three physical coast guard confrontations in a single week?

  Second Thomas Shoal and Scarborough Shoal clashes, 20-24 July

• 07
  For any asset seeking new generation or grid capacity in Wisconsin: does the deal structure already assume the credit-rating and collateral terms the PSC has now confirmed will not be revisited?

  Wisconsin PSC confirmation, 10 July
• 08
  For Virginia data centre assets: has the $0.011/kWh consumption tax, effective 1 July, been incorporated into the operating cost base, and what is the sensitivity if the rate rises alongside further state revenue pressure?

  Virginia consumption tax, effective 1 July

• 09
  For deal teams weighing new commitments into hyperscale data centre platforms: does the $40bn Aligned close and the $12bn Meta debt financing this week indicate durable capital-market appetite, or a narrowing set of consortium-scale buyers able to absorb assets at this size?

  AIP/MGX/BlackRock GIP $40bn close; BlackRock/Meta $12bn debt, both 21 July

• Re-run war-risk and continuity models against a two-strait scenario rather than a one-strait scenario. The Houthi reopening of Bab el-Mandeb means Red Sea routing can no longer be treated as an independent hedge against Hormuz disruption for shipping, insurance or trade-exposed positions.
• Audit any Gulf cloud or utility exposure against confirmed rather than claimed damage. The contested Bahrain data centre strike is a reminder that Iranian state media claims and Amazon's own status dashboard can diverge for extended periods; continuity decisions should be triggered by the latter.
• Map CADA assurance-level eligibility for any EU-facing cloud or SaaS portfolio company now. Enforcement dates sit years out, but architecture and ownership decisions taken today determine which assurance level is reachable later, and retrofitting is materially more expensive than designing for it upfront.

• Build a jurisdiction-by-jurisdiction siting risk score for US data centre pipeline, rather than a national average. Wisconsin, Virginia and Monterey Park are three different mechanisms, utility commission, state tax, municipal ballot, and each requires its own diligence track rather than a single federal-level assumption.
• Assess South China Sea corridor exposure for any subsea cable or fibre asset with Asia-Pacific routing. No cable has been touched yet, but the Gulf precedent suggests gatekeeping assertions can precede infrastructure incidents by a matter of weeks rather than months.

• Prioritise captive-generation and fixed-power data centre platforms over grid-dependent peers. This week's asset class read strengthens the case first made in earlier issues: the durable premium accrues to operators insulated from both energy-shock pricing and local financial-security mandates, not to scale alone.