Image Credentials: Image Title: Finnish Intelligence Warns Data Centres Could Pose National Security Risks. Source: (chatgpt.com) Date: June 2026. Attribution: This image was created using AI-generated imagery (chatgpt.com) by Open Chronicle and does not depict a real-world scene.
By Open Chronicle with agencies
Finland’s rapidly expanding data centre industry is drawing increasing scrutiny from the country’s intelligence services, which warn that some projects could create hidden national security vulnerabilities if foreign ownership and strategic interests are not carefully examined.
The warning comes from Finland’s Security and Intelligence Service (Supo), which says that while data centre investments bring economic benefits and support technological development, they may also be exploited by authoritarian states seeking access to sensitive information, advanced computing resources, or ways to circumvent international sanctions.
Finland has become an increasingly attractive destination for data centre investments due to its abundant low-cost electricity, cool climate, and largely emissions-free energy supply. The country already hosts around 35 large-scale data centres with capacities exceeding one megawatt, while more than 100 additional projects are currently under development.
According to Supo intelligence analyst Veli-Pekka Kivimäki, municipalities are sometimes focused primarily on the economic benefits of such projects without fully considering their security implications.
He noted that while some local authorities conduct thorough assessments, others may not fully recognize the potential national security risks associated with foreign-owned facilities.
Legal Gaps Raise Concerns
A key concern for Finnish authorities is that current legislation does not always require security agencies to be informed about new data centre projects.
Under existing rules, foreign acquisitions of Finnish companies must be reported to the Ministry of Economic Affairs and Employment. In contrast, land purchases by foreign entities undergo review by the Ministry of Defence.
However, if a foreign company leases land and constructs a data centre, or rents space within an existing facility, the project may not automatically come to the attention of national security authorities.
This creates what Supo describes as a significant blind spot, leaving local governments responsible for evaluating potential risks without always having access to the necessary intelligence or expertise.
The Finnish government has acknowledged the issue and recently proposed legislation aimed at strengthening oversight of foreign investments. If approved by Parliament, the new framework could come into force within the next year.
Concerns Over Authoritarian Influence
Supo’s concerns are particularly focused on investments linked to authoritarian states, including Russia and China.
According to Kivimäki, uncertainty about the true ownership structure of some projects presents a major challenge. Hidden links to foreign governments or state-backed entities could create opportunities for data collection, surveillance, or strategic influence.
He pointed to Chinese legislation that allows authorities to compel companies to cooperate with state security services, raising questions about where data stored or processed in foreign-owned facilities could ultimately end up.
Authorities are also concerned that foreign actors could use data centres in countries such as Finland to bypass export restrictions on advanced technologies.
High-performance computer chips used in artificial intelligence systems, for example, face strict export controls in several jurisdictions. Intelligence officials warn that foreign governments subject to sanctions or technology restrictions may seek indirect access to these capabilities through overseas investments in computing infrastructure.
Customer Verification Remains a Weak Point
Another issue identified by Supo involves customer transparency.
According to Kivimäki, some data centre operators have limited visibility into who is actually using their facilities. This lack of oversight could potentially create opportunities for criminal organizations or foreign intelligence services to operate undetected.
While the European Union’s NIS2 Cybersecurity Directive and Finland’s Cybersecurity Act require many operators to identify and verify customers, those obligations do not apply uniformly across the industry.
Smaller facilities may not fall under the same regulatory requirements unless they provide services deemed critical to national infrastructure.
Authorities believe this creates opportunities for abuse and are seeking to address the issue through additional legislation.
Stronger Oversight on the Horizon
The proposed investment permit legislation would introduce stricter oversight of large-scale data centre projects, particularly those exceeding 100 megawatts of capacity. It would also apply to facilities involved in sensitive sectors such as artificial intelligence and quantum computing, regardless of their size.
Officials hope the reforms will strengthen Finland’s ability to balance economic growth with national security considerations as demand for data infrastructure continues to rise.
Despite the concerns, Supo believes awareness of the issue is improving. Intelligence officials say both government agencies and local authorities are becoming increasingly aware of the strategic importance of digital infrastructure and the need to assess foreign investments through a security lens.
As global competition for technological dominance intensifies, Finland’s experience highlights a broader challenge facing many countries: how to attract investment in the digital economy while safeguarding critical infrastructure and sensitive data from geopolitical risks.