Two recent Royal Examiner pieces approach the data center debate from different directions. Kenneth Roko’s “The Data Center Debate Should Include Data Security” raises concerns about cybersecurity, privacy, artificial intelligence and government oversight. “We All Use Data Centers. So Where Should They Go?” looks more at our dependence on data centers and where communities should put them.
I think both raise worthwhile questions. I also think some very different technologies and risks are getting mixed together.
I’ve worked with this technology for quite a while. When I worked at digitalNATION in 1999, we mostly called it dedicated hosting. We had racks of servers hosting websites, email and other Internet services, along with dial-up Internet access.
About a decade ago, before the current generative-AI boom, I wrote my own artificial neural network from scratch as a learning project. Today I experiment with large language models running on my own hardware.
I currently have a virtual private server hosted in Richmond, which I back up daily to a separate off-site service. I’ve used many web-hosting providers over the years. I also have a Bitcoin miner hosted in Texas.
Those are all very different uses of data centers.
I’m fascinated by this technology and use it every day. But I’m opposed to the most recent Warren County data center proposal because I think the technological, infrastructure and financial risks deserve much firmer answers before we make decisions whose consequences could last for decades.
Data Centers Aren’t One Giant AI Network
There is some truth to the idea of AI computers being connected together, but it’s important to understand what that means.
Inside a large AI cluster, a single rack can contain multiple computers and specialized processors connected with extremely fast links. NVIDIA’s GB200/GB300 NVL72 rack design, for example, can put 18 compute nodes containing 72 GPUs into a single rack, with NVLink allowing those GPUs to function as a single multi-GPU unit. Fifth-generation NVLink supports up to 576 GPUs, allowing GPUs to act as one. Even at its architectural ceiling, that’s a few racks in one room, not a country’s worth of data centers.
A model can even be divided among multiple GPUs or multiple computers so their combined memory and computing power can handle something too large for one processor.
At home, I have two GPUs in one computer. I’ve also experimented with distributed AI in a different way. I’ve built a system where several computers can each receive a small piece of a document, run a model against it, and return a result. Rather than trying to make all the computers behave as one enormous computer, I divide the work among them.
There are also technologies that actually split a single model across multiple computers. NVIDIA, for example, supports extending high-speed GPU communication across multiple compute nodes.
But that’s a purpose-built cluster operated as a system. It’s very different from assuming independent data centers scattered across the United States automatically pool their computing resources or send everyone’s information into one central repository.
Communication speed is one of the reasons this distinction matters.
AI models have to move enormous amounts of information extremely quickly while performing calculations. Even ordinary system memory is substantially slower than the high-speed memory attached directly to modern GPUs. Storage is slower still, and an ordinary computer network creates another bottleneck.
That’s a major reason AI companies spend so much money on GPUs, high-speed memory and specialized connections between processors.
So yes, AI systems can be distributed across networks—even very large networks. But that doesn’t mean America’s data centers collectively form one giant AI computer.
A company or government certainly could intentionally build a distributed system that sends information to a central repository. The relevant privacy question is whether a particular service actually does that, not simply whether its computers reside in data centers.
Data Security Is Important, but It Isn’t New
I agree with Kenneth Roko on an important point: data security deserves to be part of the conversation.
Where I differ is the suggestion that the government hasn’t developed security frameworks for these systems.
We’ve been dealing with cybersecurity and data protection for decades.
I’ve worked on government systems with firewalls separating servers, application logic and databases, along with intrusion detection. I’ve managed databases where we performed differential backups every day and physically shipped backup tapes to two separate locations so that losing one facility couldn’t destroy every copy.
Today, backups can be encrypted. Servers can use encrypted drives so that stealing the physical drive doesn’t automatically provide access to its contents. Information traveling between a browser and website is routinely encrypted through HTTPS. Modern browsers commonly warn users when that protection isn’t present.
None of this makes a system impossible to compromise.
If an attacker compromises a running server, steals credentials or obtains encryption keys, encryption isn’t a magic shield. Security has always involved layers.
The privacy question therefore isn’t simply, “Is my information in a data center?”
It’s: Who has access to it? What are they permitted to do with it? How long do they retain it? What information do they collect in the first place? And how effectively do they protect it from everyone who isn’t supposed to have access?
A data center is infrastructure. The important questions concern what is running there and who controls the information.
There is also considerable federal work on these issues. NIST has its Cybersecurity Framework and Artificial Intelligence Risk Management Framework. In July 2026, NIST published an initial public draft of SP 800-239, “AI Data Center Security Analysis,” specifically examining security threats involving AI training, inference, applications, hardware, software and storage.
The fact that SP 800-239 is still a draft actually illustrates that this remains an active and developing area of cybersecurity policy.
There is, however, an important part of Roko’s concern that I think deserves more attention: having a framework is not the same as having a mandatory standard.
The NIST frameworks are generally voluntary guidance rather than universal federal requirements imposed on every private data center. So I wouldn’t say there are no security frameworks or that government hasn’t been working on them. I would ask a more practical local question:
If Warren County believes particular cybersecurity protections are important, which protections can and should actually be required of this project rather than simply assumed?
Blockchain Doesn’t Solve This
I would also be cautious about treating blockchain as a solution to data-center security.
Blockchain has become something of a buzzword. There are useful technologies built around it, but understanding blockchain requires understanding a collection of technologies: cryptography, wallets, private keys, distributed networks, consensus mechanisms, smart contracts and the infrastructure surrounding them.
Then there are the scams.
It can take quite a while to understand that ecosystem well enough to recognize where the actual protections end and where the risks begin.
A blockchain can provide useful properties for certain applications, particularly maintaining a distributed record that is difficult to alter retroactively. That doesn’t automatically make the information surrounding it secure. Someone can still steal credentials or private keys, exploit software, compromise a computer, trick a person into authorizing something, or steal information before it ever reaches the blockchain.
Knowing is half the battle.
Technology doesn’t eliminate the need to understand what you’re protecting, who you’re trusting and where the vulnerabilities actually are.
AI Is Changing Too Quickly to Treat Today’s Hardware as Permanent
AI is already becoming part of ordinary computing. It’s increasingly built into browsers, operating systems, phones, websites and everyday software.
But not all of that AI requires an enormous data center.
Some models are already small enough to run directly on phones and personal computers. I’ve been running larger models locally on gaming hardware myself.
Developers have made remarkable progress reducing the memory required by models and dividing work between GPU memory, ordinary system RAM and the CPU.
Some newer models also use a “mixture of experts” approach. An easy way to think about that is a large company filled with specialists. You don’t ask every employee to work on every problem. You activate the specialists needed for that particular piece of work.
There is an enormous financial incentive to figure out how to accomplish the same AI tasks with less hardware, less electricity and less expense.
International adoption demonstrates another part of the uncertainty. Microsoft’s Q1 2026 Global AI Diffusion Report estimated generative-AI usage among the working-age population at 31.3% in the United States, 37.1% in South Korea, 63.4% in Singapore and 70.1% in the United Arab Emirates.
The United States remains one of the world’s centers for AI infrastructure and frontier-model development, yet Microsoft ranked it only 21st in population-level AI usage in Q1 2026. Twenty-six economies had already exceeded 30% adoption.
That gap is another reminder that AI infrastructure, AI adoption, computing efficiency and local processing don’t necessarily move together at the same rate.
That’s why I don’t think anybody can confidently tell Warren County what an AI server will look like in 2036, much less 2046.
Maybe today’s enormous GPU clusters remain necessary.
Maybe AI usage grows so rapidly that efficiency improvements are overwhelmed and we need substantially more computing infrastructure.
Or maybe today’s approach eventually looks like a brute-force stage on the path to something much more efficient.
I don’t know.
That’s precisely the point.
Technology companies can gamble billions of dollars on which future occurs. Warren County can’t.
The Electrical Infrastructure Is Not a Minor Detail
This is where Virginia’s own research becomes particularly important.
JLARC commissioned an independent forecast and grid analysis for its 2024 data center study. It found that data centers are the main driver behind an enormous projected increase in Virginia’s electricity demand.
Its analysis concluded that meeting unconstrained demand would require a substantial amount of new generation and transmission infrastructure—and that even meeting half of unconstrained demand would be difficult.
Under some modeled scenarios, new solar facilities would have to be added at roughly twice Virginia’s 2024 annual construction rate. Additional wind, natural-gas generation, battery storage and transmission capacity would also be required.
Most strikingly, JLARC concluded that both of its modeled scenarios would rely on energy from “as yet unproven nuclear technologies.” A few small modular reactors (SMR) exist worldwide in China and Russia. Nearly all nuclear reactors currently under construction are large scale, most with capacities above 1,000 megawatts.
That’s particularly relevant to this discussion. Virginia is being asked to plan long-lived infrastructure around projections that, in JLARC’s own modeling, may depend partly on generating technology that has not yet been proven at the scale envisioned.
That puts questions such as these near the center of the discussion:
What infrastructure has to be constructed?
Who pays for it?
Who assumes the risk if projected demand doesn’t materialize?
What costs could eventually be spread among other utility customers?
And what happens if the technology changes enough that some of that projected computing demand disappears?
DOE’s national research shows why utilities and developers are taking the demand seriously. Its 2024 report estimated that data centers consumed about 4.4% of U.S. electricity in 2023 and projected they could consume roughly 6.7% to 12% by 2028.
JLARC found that utilities’ existing customer base ultimately bears the risk if the data centers close as utilities recoup the costs. Besides risk of closure, the same report estimates that residents could end up paying $14 to $37 per month by 2040 for generation and transmission related costs, simply related to data center demand.
So I’m not arguing that today’s demand isn’t real.
It very clearly is.
I’m arguing that building long-lived infrastructure around forecasts for an extraordinarily fast-changing technology requires careful decisions about who bears the risk if those forecasts are wrong.
So Where Should Data Centers Go?
The other Royal Examiner commentary asks an important question: if we all use data centers, where should they go?
Initially, my instinct is to say we should expand them where data centers already exist because the infrastructure and major Internet connections are already there.
Virginia’s own research shows why the answer isn’t quite that simple.
Northern Virginia already has extraordinary data-center infrastructure, fiber connectivity and proximity to major Internet networks. But JLARC’s grid analysis also found that meeting projected demand would require many additional transmission projects, particularly in and around Northern Virginia.
So simply saying “put more where they already are” doesn’t solve the problem.
I think the better principle is this:
Put major data-center development where independent analysis shows that the marginal cost and community impact of providing the necessary electricity, transmission, fiber, water and other infrastructure are acceptable—and where the parties creating the demand bear an appropriate share of those costs and risks.
Sometimes that may mean expanding an established data-center region.
Sometimes it may mean another location where sufficient infrastructure already exists.
And sometimes the answer may be that a particular site simply doesn’t make economic or infrastructure sense.
“We all use data centers” doesn’t mean every community therefore needs to host one.
We all use airports, distribution warehouses, power plants, landfills and water-treatment facilities. That doesn’t make every locality equally suitable for every kind of infrastructure.
For Warren County, I want to know what has to be built specifically to make this location work and why locating the facility here makes more sense than the alternatives.
Local Impacts Still Matter
A large data center operates 24 hours a day, seven days a week. Cooling equipment operates continuously. Backup generators require testing. Electrical demand can be enormous.
Virginia’s JLARC study documented complaints about persistent low-frequency noise near some data centers while also noting that most Virginia data centers don’t generate such complaints, often because of their location or design.
Both findings matter.
Noise isn’t inevitable, but neither is it imaginary.
Virginia has also changed its law since the JLARC report. Under § 15.2-2209.5, for a proposed new “high energy use facility” that the applicant reasonably anticipates will require 100 megawatts or more from the serving electric utility, the locality must require a site assessment before approving certain rezoning, special-exception or special-use-permit applications. That assessment must examine, to the extent practicable, the facility’s sound profile on residences and schools within 500 feet of the property boundary.
For comparison on energy use, an average Virginia town of 10,000 people uses approximately 10 megawatts, and the 2025 US Census estimate for Front Royal alone was 15,722 residents which may use around 16 megawatts alone – far less than the requirements for a high energy use facility. By comparison, the 2025 population estimate for Warren county was 42,740.
The locality may also require the assessment to examine effects on ground and surface water, agriculture, parks, registered historic sites and forestland.
That’s a useful step.
But a study isn’t the same thing as an operational limit.
If a developer says neighbors won’t hear the facility, put a measurable noise limit into the conditions governing the project.
If adequate buffering is promised, specify the buffer.
If economic benefits are promised, identify which are estimates and which are legally enforceable commitments.
The more confident everyone is that these problems won’t occur, the less objection there should be to putting the protections in writing.
Projected Benefits Aren’t Guaranteed Benefits
This remains my biggest concern with the most recent Warren County proposal.
What tax revenue is actually guaranteed?
What infrastructure must be constructed?
Who funds it?
What happens if projected electrical demand never materializes?
What happens if the facility changes owners?
What happens if it drastically scales back operations?
What happens if the equipment inside becomes obsolete much sooner than expected?
JLARC found that much of the economic activity associated with data centers occurs during construction. Industry representatives described a typical 250,000-square-foot facility as having approximately 50 full-time workers, about half contractors, compared with around 1,500 workers during peak construction.
That doesn’t mean a data center provides no economic benefit.
It means construction activity, projected economic impact, projected tax revenue and guaranteed long-term benefits aren’t interchangeable terms.
Before approving a facility of this scale, I’d like to know exactly where the risks reside—not simply where everyone hopes they’ll land.
Specific Concerns Are Different From Blanket Opposition
I also think two different conversations are occurring locally.
Some residents have specific concerns about noise, electrical infrastructure, property impacts, taxes, water, location or financial risk. Those concerns can be measured, discussed and potentially addressed.
Others oppose data centers under essentially any circumstances.
Those are different positions.
If we’re discussing responsible development, it helps to identify exactly what concerns us and what protections could address those concerns.
For me, even if many of the physical concerns could be mitigated, the financial and technological uncertainty would still make me extremely cautious about the most recent proposal.
What Concerns Me Most
I’ve watched computing change dramatically since I was standing around racks of dedicated web servers in 1999.
I’ve experimented in many forms of artificial intelligence ranging from Eliza and Alice chatbots, speech synthesis, genetic algorithms, and more. I later built an artificial neural network because I wanted to understand how the technology worked when artificial neural networks started to gain attention again with ImageNet’s visual recognition challenge that led to Google’s image classification search and the famous match of Go of Lee Sedol vs AlphaGo in 2016. Today I’m running modern AI models on my own hardware, distributing AI workloads among computers, and watching developers find ways to accomplish more with less memory, less expensive hardware and less power.
I’m fascinated by AI. I use it daily.
That’s part of why I’m hesitant to bet Warren County’s future on assumptions about how AI will operate decades from now.
Before the most recent proposal is approved, I want answers to the important questions to be legally binding rather than promises.
What happens if the facility is sold?
What happens if projected demand never materializes?
Who ultimately pays for infrastructure built to serve it?
What happens if substantially less computing hardware is needed ten years from now?
What protections do neighboring property owners have?
What tax revenue is actually guaranteed rather than merely projected?
Virginia provides qualifying data centers with a state sales-and-use-tax exemption on qualifying computer equipment and enabling hardware, including items such as servers, routers, chillers and backup generators. Under current law, that exemption extends through June 30, 2035.
Technology companies and investors are betting on the future value of AI infrastructure.
My concern is making sure Warren County and its residents aren’t making that bet on their behalf.
We can’t predict what AI will look like ten or twenty years from now.
We can make sure that if those predictions turn out to be wrong, Warren County isn’t left holding risks that should belong to the companies making the investment.
Sources and Further Reading
Royal Examiner — “The Data Center Debate Should Include Data Security” (September 20, 2026)
The Kenneth Roko letter that prompted the discussion of data security, interconnected AI systems, privacy, cybersecurity standards and blockchain.
Royal Examiner — “Commentary: We All Use Data Centers. So Where Should They Go?” (September 20, 2026)
The related commentary that prompted the broader question of where data centers should be located and whether society’s dependence on data centers means every community is an appropriate location for one.
Virginia Joint Legislative Audit and Review Commission (JLARC) — “Data Centers in Virginia” (December 9, 2024)
Used for Virginia-specific information concerning electricity demand, generation and transmission requirements, employment, economic effects, noise and siting. JLARC’s independent modeling found substantial new generation and transmission would be needed to meet projected demand and that even meeting half of unconstrained demand would be difficult.
JLARC’s analysis also found that both modeled scenarios would rely on as-yet-unproven nuclear technologies, in addition to substantial expansion of solar, wind, natural gas, battery storage and transmission. That uncertainty is particularly relevant when considering long-term infrastructure commitments based on projected data-center demand.
The report also includes the example provided by industry representatives of a typical 250,000-square-foot data center employing approximately 50 full-time workers, about half of them contractors, compared with approximately 1,500 workers during peak construction.
https://jlarc.virginia.gov/landing-2024-data-centers-in-virginia.asp
Virginia JLARC — “Data Centers in Virginia” Report (December 9, 2024)
The full report provides additional detail on JLARC’s modeled electricity scenarios and the amount of generation, storage and transmission infrastructure potentially required.
https://jlarc.virginia.gov/pdfs/reports/Rpt598.pdf
U.S. Department of Energy — “DOE Releases New Report Evaluating Increase in Electricity Demand from Data Centers” (December 20, 2024)
Used for national data-center electricity consumption and demand projections. DOE reported that data centers consumed approximately 4.4% of U.S. electricity in 2023 and projected approximately 6.7% to 12% by 2028.
This provides national context for why utilities and developers are taking projected data-center electricity demand seriously, while the article separately questions how the financial risk of long-lived infrastructure should be allocated if future demand differs from current forecasts.
NIST — “AI Data Center Security Analysis: A High-Performance Computing (HPC) Driven Approach,” Initial Public Draft SP 800-239 (July 27, 2026)
Used to demonstrate that the federal government is actively developing security guidance specifically for AI data centers. Published in July 2026, the draft examines AI training, inference, applications, hardware, software, workflows, storage and security threats.
Its recent draft status also illustrates that AI-data-center security remains an actively developing area rather than a subject for which every question has already been settled.
https://csrc.nist.gov/pubs/sp/800/239/ipd
NIST — Cybersecurity Framework 2.0 (February 26, 2024)
Used to demonstrate the existence of a broader federal cybersecurity-risk framework. It is important to distinguish the existence of federal guidance from a universal mandatory cybersecurity standard imposed on every privately operated data center.
https://www.nist.gov/cyberframework
NIST — Artificial Intelligence Risk Management Framework (AI RMF 1.0) (January 26, 2023)
Used for the discussion of federal work addressing AI risk. The framework provides voluntary guidance for organizations developing, deploying and using artificial intelligence.
This supports an important distinction in the article: federal cybersecurity and AI-risk frameworks exist, while legitimate questions remain about which protections are actually mandatory.
https://www.nist.gov/itl/ai-risk-management-framework
Code of Virginia § 15.2-2209.5 — “Siting of Data Centers; Site Assessment” (2026 Acts of Assembly, Chapters 567 and 568)
Used for Virginia’s current data-center siting requirements. The statute defines a “high energy use facility” as one an applicant reasonably anticipates will require 100 megawatts or more of electrical power from its retail electric utility.
Before approving certain land-use applications for a new covered facility, a locality must require a site assessment examining, to the extent practicable, the facility’s sound profile on residences and schools within 500 feet of the property boundary. A locality may also require assessment of effects on ground and surface water, agricultural resources, parks, registered historic sites and forestland.
The law was enacted by 2026 Acts of Assembly, Chapters 567 and 568, originating as House Bill 153 and Senate Bill 94.
https://law.lis.virginia.gov/vacode/title15.2/chapter22/section15.2-2209.5
Microsoft — Q1 2026 Global AI Diffusion Report (May 7, 2026)
Used for the international comparison of generative-AI usage among working-age populations. The Q1 2026 report provides the underlying country-level figures used in the article, including approximately 31.3% for the United States, 37.1% for South Korea, 63.4% for Singapore and 70.1% for the United Arab Emirates.
The comparison is included to illustrate that AI infrastructure, AI development and population-level adoption don’t necessarily move together. The United States is a major center of frontier-model development and AI infrastructure while ranking well below several countries in Microsoft’s population-normalized usage measure.
Microsoft — “The State of Global AI Diffusion in 2026” (May 7, 2026)
Microsoft’s accompanying May 2026 discussion of the Q1 report. It provides additional context about changes in AI adoption and reports that U.S. usage increased to 31.3%, moving the United States from 24th to 21st in Microsoft’s global ranking.
https://blogs.microsoft.com/on-the-issues/2026/05/07/the-state-of-global-ai-diffusion-in-2026
NVIDIA — DGX GB Rack Scale Systems: Hardware (September 17, 2026)
Used to support the description of how modern AI hardware can combine many processors within a rack. NVIDIA’s GB200/GB300 architecture provides a concrete example: an NVL72 rack contains 18 compute trays, each with CPUs and four Blackwell GPUs, along with nine NVLink switch trays connecting the GPUs.
This illustrates why a modern AI “server” can actually consist of many interconnected computing systems rather than a single conventional computer.
https://docs.nvidia.com/dgx/dgxgb200-user-guide/hardware.html
NVIDIA — DGX GB Rack Scale Systems: Networking (September 17, 2026)
Used to explain why communication speed is so important when distributing AI computation. NVIDIA describes NVLink as the high-speed fabric connecting GPUs within a rack, while InfiniBand provides high-bandwidth, low-latency communication between racks in larger AI training clusters.
The documentation describes NVLink as allowing the 72 GPUs within an NVL72 rack to operate as one high-speed computing domain. This supports the distinction made in the article between a deliberately engineered distributed AI cluster and independent data centers simply being connected to the Internet.
https://docs.nvidia.com/dgx/dgxgb200-user-guide/networking.html
NVIDIA — Enterprise Reference Architecture (May 2025)
Used for the discussion of larger multi-node GPU systems. NVIDIA describes extending high-bandwidth GPU connectivity across multiple nodes so workloads can be distributed among many servers—effectively allowing a purpose-built cluster to behave like a much larger computing system.
This is an important context for Kenneth Roko’s point: very large interconnected AI systems are technically real. The distinction is that such systems are intentionally engineered and operated as coordinated clusters; the existence of multiple data centers does not by itself mean those facilities automatically share their computing resources or feed information into a common repository.
https://docs.nvidia.com/enterprise-reference-architectures/white-paper.pdf
Virginia Code § 58.1-609.3 — Commercial and Industrial Exemptions — current law
Used for Virginia’s sales-and-use-tax exemption for qualifying data centers. The statute exempts qualifying computer equipment and enabling software purchased or leased for use in qualifying data centers, including servers, routers, storage systems, generators, chillers and related enabling hardware. Under current law, the exemption applies to qualifying purchases through June 30, 2035.
https://law.lis.virginia.gov/vacode/title58.1/chapter6/section58.1-609.3
International Conference on Small Modular Reactors and Their Applications — October 21-25, 2024
Reports that Russia operates floating Akademik Lomonosov KLT-40S reactor modules.
https://www-pub.iaea.org/MTCD/Publications/PDF/p15790-PUB9062_web.pdf
IEA — Technology: Nuclear — 2026
One SMR is under construction in China, and one in Russia. More projected in Canada, Korea, United Kingdom, and United States.
https://www.iea.org/reports/global-energy-review-2026/technology-nuclear
INET — Chinese HTR-PM Demo begins commercial Operation — December 7, 2023
A small modular reactor comes online in Shidao Bay, Shandong Province of China.
https://www.inet.tsinghua.edu.cn/ineten/info/1024/1698.htm
United States Census Bureau — Quick Facts: Front Royal town, Warren County, Virginia (July 1, 2025)
Population estimate of Front Royal as of July 1, 2025 based on April 1, 2020 census results at 15,722 and Warren County at 42,740.
https://www.census.gov/quickfacts/fact/table/frontroyaltownvirginia,warrencountyvirginia
The Guardian — Google’s AlphaGo AI defeats human in first game of Go contest — March 9, 2016
Without a handicap, Google’s AlphaGo (Designed by DeepMind), beat Lee Sedol, thought to be one of the strongest players at Go, scoring a victory in a very creative way. It shocked the world and was a major breakthrough for AI. After this article, there were four additional matches, in which AlphaGo only lost one.
Lewis Moten — Artificial Neural Network (June 24 to August 23, 2016)
My earlier artificial-neural-network learning project, included to document my statement that I experimented with building a neural network from scratch years before the current generative-AI boom.
https://github.com/lewismoten/artificial-neural-network
Alex Krizhevsky, Ilya Sutskever, Geoffrey Hinton — ImageNet Classification with Deep Convolutional Neural Networks — 2012
AlexNet was the only neural-network approach in the 2012 competition with only 15.3% top-5 error while second place was at 26.2%. The following year, deep neural networks had taken over the field, eventually falling below measured human performance.
