Finnish security researcher warns of data centre ownership risks

A senior researcher at Finland’s Security Intelligence Service (Supo) has warned of risks tied to foreign ownership of data centres, noting that authoritarian states may conceal their involvement through complex corporate structures.

Veli-Pekka Kivimäki told Finnish news agency STT that such ownership could enable illegal cyber espionage, with the aim of accessing data stored in the facilities.

“If data is stolen, it is in a way irreversible,” Kivimäki said.

He highlighted that Finland currently has no mandatory reporting requirements for data centre projects, meaning authorities often learn of plans late.

“We have no binding regulation that would compel anyone to disclose that a data centre project is coming,” he said.

Kivimäki added that a proposed investment screening law, now under review, would help mitigate risks by making data centre projects subject to oversight, ensuring authorities receive early notice.

He also noted that not all data centres are required to verify their clients’ identities in the same way banks must to prevent money laundering.

STT reported that in May, Dutch police seized 800 servers from two data centres in the Netherlands, which Bloomberg said had been used by Russian hackers in cyberattacks.