If you wanted to blow something up to make the west suffer, an AWS datacenter would probably be a pretty good target. I wonder at what point that becomes a legitimate national security concern, and the government steps in to provide protection.
The US has no terrorism problem. In 1979, the Irish killed the Queen's uncle in law, and in 1984, they blew up a hotel where Thatcher was staying. That's a serious terrorism problem! What the US has is nothing by comparison. We were unlucky on 9-11, and ever since we've been distorting our foreign policy out of unreasonable fear.
There are a LOT of far softer targets that go unprotected. A terrorist attack on a sewage plant for a major city would be far more devastating than knocking out a few websites.
There's probably a moderate amount of unseen security in larger areas surrounding water/sewage plants.
Also, we've dealt with regional natural disasters before. Drought, fire, flooding, etc - we have experience mobilizing resources and redistributing as needed.
We've never dealt with an extended outage of one or more AWS data centers for days at a time. How many govt/university systems would be unable to function because of direct or indirect dependencies on AWS-related services?
S3 going down for, let's say 4 days, would cause big havoc on so many projects and systems I know of.
I'm pretty sure most people have no clue how much of their data and systems functionality is reliant on AWS-related services.
Water outages happen often enough - they distribute water manually with tanker trucks. When sewage is overwhelmed it overflows into a river and they tell people to not go for a swim. https://en.wikipedia.org/wiki/Sanitary_sewer_overflow
Some people wouldn't be able to do their computer work, send receive emails, others might not receive their paychecks or be able to pay bills.
The sewage plant hits both physiological needs and safety needs (it's a pretty dire health threat quickly). AWS has weak tendrils to financial safety, but mostly affects layers above that.
And, I think even more than we can imagine. It's one thing to count the number of services that are direct customers/dependents of AWS, and we really don't know how deep that goes.
But, add to that the non-AWS based services that directly or indirectly rely on AWS-based services.
It wouldn't surprise me if those police systems have moved, or are moving, to Azure or AWS data centers.
It's much worse if benefits or paychecks don't get paid. For many people that means that they won't be able to buy groceries as soon as a few days later. Not the standard HN crowd, but many people depend on regular paychecks and can be in trouble if it comes even one day late.
Funny thing with the police, in the 60s there was flooding and they couldn't coordinate a response, so radio amateurs had to step in and provide comms. Those enthusiasts are still around under the codename RAYNET. The police eventually got their act together and invested in a system called TETRA which is self-contained and independent of any other infrastructure so they would never be caught with their pants down again.
Now they've ditched TETRA to save money and they just run over the 4G network like anyone else...
If you hit AWS, just Netflix alone is going to effect 100 million people. There are definitely a few payroll providers that are going to have some reliance, so people all over are going to stop receiving their paycheques. Many businesses will be temporarily disabled.
On a national level we've got a lot more eggs concentrated in the AWS baskets than we do the sewage treatment baskets.
According to this rackspace article, the largest AZ has 5 data centres.
https://blog.rackspace.com/aws-101-regions-availability-zone...
The abstraction behind AZs is what every AZ counts for at least 1 data centre. So for every region there is at least 2 AZs, and every AZ means at least 1 data centre (or 5 in your link).
This just means it's harder to take out a whole region by destroying individual data cetnres. Since most regions consist of 2-5 AZ, and AZs consist of 5+ data centres, that means destroying dozens of data centres.
I know my company and a few others that are redundant within a region (ie if one AZ goes down), but not if a whole region goes down.
When you widen the potential attack surface to include software vulnerabilities, unauthorized access, process flaws and other "soft" vectors, a much wider--possibly coordinated--attack that is potentially far more crippling can be imagined.
Of course just speculation, I have no knowledge about DR plans at Amazon.
However, we actually have evidence that a sewage plant for a major western city can suffer a sudden catastrophic failure[1] and it won't even make it above the fold.
http://www.economist.com/news/world-if/21724908-huge-potenti...
Of course, if you completely remove an entire AWS region you might induce very damaging stresses on other regions as people fail over.
But, yeah, I'm kinda' surprised that this HN crowd in particular is so focused on hardware vectors.
I imagine Amazon has some on site security measures as well.
It would be interesting to see how important services would cope with their main region going down for more than a few days.
You don't need to severe both power and data cables. For power the datacentre should be able to cope for a while, particularly if it has access to fuel deliveries. Data cable should be both easier to severe and more difficult to recover from (not the least to identify which cable has been cut where).
Most of the infrastructure of a country in term of cables run along railway tracks, sewers, etc. This means thousands of kilometers of cable even for a small country, and it is impossible to secure everything. It is impossible to severe everything either but you don't need to severe every single cable. As long as you severe enough of the backbone, the other cables will be overloaded.
So I don't think it would take that much effort for a network of terrorists to create havoc in the communications of a country for at least a few days to a week. And the consequences for the economy can be pretty dire. We have seen with BA what happens when their datacentre goes offline. Their all fleet is grounded. I imagine the consequences of a country-wide outage could be pretty dramatic. Unlikely anyone would die but you could really dent the GDP.
If you wanted that type of destruction, and be noticed, you would need a city leveler type event in a data center heavy area.