More from the article ...

... In 2024, U.S. officials shut down a Chinese-owned data facility near a nuclear missile base in Wyoming, fearing Beijing's surveillance. But as commercial data centers expand rapidly across the globe, a similar threat has gone virtually unnoticed -- American and Chinese companies leasing space under the same roof. In a shared data center, an attacker doesn't need to execute a complex hack to steal sensitive data. They can simply walk in, plant a spying device nearby, or alter physical hardware. ...

Many of the world's data centers operate through a model called "colocation," where multiple companies lease racks of servers in the same facility, sharing electricity, cooling, and network connections. Colocation accounts for more than 90 percent of public data centers worldwide and roughly a fifth of global computing capacity.

It's an efficient model for both data center owners and companies looking to house their data. But it also means an American company could be training its most advanced models just one rack away -- that is, inches -- from a Chinese tenant bound by Beijing's intelligence laws.

Colocation assumes that neighbors can't reach into each other's racks. In reality, servers are swapped constantly, often by short-term, local contractors performing routine maintenance.

A tenant or technician with consistent access could easily bypass basic safeguards such as keycard doors, cameras, and access logs to plant surveillance gear nearby or replace basic components with parts that have been altered to send information elsewhere.

It turns out that good old fashioned spycraft takes far less energy than a complicated hack, even for a sophisticated adversary. And while tampering is possible anywhere in the world, it is much easier overseas, away from stronger oversight and American regulatory guardrails.

Colocation also carries digital risks. Flaws in virtualization software, GPUs, and even management and cooling systems routinely surface, sometimes letting one tenant peer into another's environment or disrupt operations. Patching them quickly doesn't alter the fact that shared infrastructure means vulnerabilities are easier to exploit. ...